/**
 * visus_scan_mcp - MCP Configuration Risk Scanner
 *
 * Scans MCP server parameters for RCE, shell injection, and env abuse risks.
 * Integrates with existing sanitizer for pattern detection.
 */
type RiskSeverity = 'low' | 'medium' | 'high' | 'critical';
interface Finding {
    pattern: string;
    location: string;
    snippet: string;
    severity: RiskSeverity;
}
interface ScanResult {
    findings: Finding[];
    score: number;
    safeToSpawn: boolean;
    remediation: string[];
    mcp_risks: string[];
    command_risks: CommandRisk[];
}
import { type CommandRisk } from '../../security/command-guard.js';
export interface ScanResult {
    findings: Finding[];
    score: number;
    safeToSpawn: boolean;
    remediation: string[];
    mcp_risks: string[];
    command_risks: CommandRisk[];
}
export declare function visusScanMcp(input: {
    config: string;
    options?: {
        mode?: 'strict' | 'balanced' | 'permissive';
        whitelist?: string;
    };
}): Promise<ScanResult>;
export declare const visusScanMcpToolDefinition: {
    readonly name: "visus_scan_mcp";
    readonly description: "Scan MCP server configuration parameters for security risks before spawning. Pass config as JSON string: {command?: string, args?: string[], env?: object}. Returns findings, score, and remediation advice.";
    readonly inputSchema: {
        readonly type: "object";
        readonly properties: {
            readonly config: {
                readonly type: "string";
                readonly description: "JSON string of MCP params to scan (e.g., {\"command\": \"node\", \"args\": [\"index.js\"], \"env\": {}})";
            };
            readonly options: {
                readonly type: "object";
                readonly properties: {
                    readonly mode: {
                        readonly type: "string";
                        readonly enum: readonly ["strict", "balanced", "permissive"];
                        readonly default: "balanced";
                        readonly description: "Risk tolerance: strict blocks more aggressively";
                    };
                    readonly whitelist: {
                        readonly type: "string";
                        readonly description: "Comma-separated patterns to ignore (e.g., \"shell_injection,high_entropy_payload\")";
                    };
                };
                readonly required: readonly [];
            };
        };
        readonly required: readonly ["config"];
    };
};
export {};
//# sourceMappingURL=mcp-config-scan.d.ts.map