/**
 * Sandbox Audit Scanner
 *
 * Verifies that MCP tools don't escape their declared surface area.
 * Performs static analysis to detect potential sandbox escapes:
 * - child_process usage in "read-only" tools
 * - eval/Function usage for code execution
 * - Raw network access in local-scoped tools
 * - Filesystem access outside declared paths
 *
 * @module scanners/agent/sandbox-audit
 */
import type { Severity } from "../../certification/types.js";
import type { AgentScannerResult, MCPManifest } from "./types.js";
/**
 * Run sandbox audit scanner
 */
export declare function runSandboxAudit(manifest: MCPManifest, options?: {
    /** Path to scan for source files */
    sourcePath?: string;
    /** Maximum directory depth */
    maxDepth?: number;
    /** Patterns to exclude */
    exclude?: RegExp[];
    /** Only check specific tools */
    tools?: string[];
}): Promise<AgentScannerResult>;
/**
 * Check if sandbox audit is available
 */
export declare function checkSandboxAuditAvailable(): Promise<{
    scanner: "sandbox-audit";
    available: boolean;
    version: string;
}>;
/**
 * Get sandbox audit summary
 */
export declare function getSandboxAuditSummary(result: AgentScannerResult): {
    totalFindings: number;
    byType: Record<string, number>;
    bySeverity: Record<Severity, number>;
} | null;
//# sourceMappingURL=sandbox-audit.d.ts.map