/**
 * Runtime CVE gate — optional; blocks tools/call only when explicitly enabled.
 *
 * Default: OFF (GUARDIAN_BLOCK_ON_CVE must be "true").
 * When on: blocks only CRITICAL CVEs by default (set GUARDIAN_CVE_BLOCK_SEVERITY=HIGH to widen).
 */
import type { IDatabase } from '../database/database-interface.js';
import type { CveFinding } from '../types.js';
export interface CveGateResult {
    block: boolean;
    reason?: string;
    cves?: CveFinding[];
}
/** CVE runtime blocking is opt-in — avoids false-positive storms from transitive dep scans. */
export declare function isCveGateEnabled(): boolean;
export declare function evaluateCveGate(db: IDatabase, serverName: string): Promise<CveGateResult>;
//# sourceMappingURL=cve-gate.d.ts.map