/**
 * Access control for the HTTP Stream transport.
 *
 * The server holds API keys and spends their rate limits, so anything that
 * can reach the port can use them. The rule is:
 *
 * - With MCP_AUTH_TOKEN set, every MCP request must carry
 *   `Authorization: Bearer <token>`. That covers /mcp (POST, GET, DELETE)
 *   and the legacy /sse stream; /health and /ping stay open for probes.
 * - Without a token, the server listens only on loopback addresses.
 *   Binding anything else (MCP_HOST=0.0.0.0, a LAN address, …) is refused
 *   unless MCP_ALLOW_INSECURE_HTTP=1 says a proxy in front of it handles
 *   authentication.
 *
 * TLS isn't handled here; terminate it in a reverse proxy.
 */
import type { IncomingMessage } from "node:http";
export declare const MIN_TOKEN_LENGTH = 16;
export type HttpAuthPlan = {
    mode: "token";
    token: string;
} | {
    mode: "none";
    reason: "loopback" | "insecure-override";
};
/** True for localhost, ::1 and 127.0.0.0/8. */
export declare function isLoopbackHost(host: string): boolean;
/**
 * Decide how the HTTP transport is protected for this host and environment.
 * Throws with an explanation when the combination is unsafe.
 */
export declare function planHttpAuth(host: string, env?: NodeJS.ProcessEnv): HttpAuthPlan;
/**
 * FastMCP `authenticate` hook that accepts `Authorization: Bearer <token>`.
 * Anything else is rejected with a thrown 401 Response, which FastMCP's HTTP
 * layer sends as is (including for the /sse stream).
 */
export declare function bearerAuthenticator(token: string): (req: IncomingMessage | undefined) => Promise<{
    authenticated: true;
}>;
//# sourceMappingURL=http-auth.d.ts.map