declare const MCP_PERMISSION_PROFILES: readonly ["default", "docs", "repo", "browser", "graph"];
export type McpPermissionProfile = typeof MCP_PERMISSION_PROFILES[number];
export declare function canWriteConfig(env?: NodeJS.ProcessEnv): boolean;
export declare function configWriteDeniedMessage(): string;
export declare function getMcpPermissionProfile(env?: NodeJS.ProcessEnv): McpPermissionProfile;
export declare function canCallMcpTool(toolName: string, env?: NodeJS.ProcessEnv): boolean;
export declare function filterAllowedMcpTools<T extends {
    name: string;
}>(tools: readonly T[], env?: NodeJS.ProcessEnv): T[];
export declare function mcpToolDeniedMessage(toolName: string, env?: NodeJS.ProcessEnv): string;
export {};
/**
 * Recommended MCP permission profiles:
 *
 * - default : Read-only project info, goals, runs, and memory. Safe for general use.
 * - docs    : Includes default + write access to memory and ontology. For documentation agents.
 * - repo    : Includes docs + quality gates and evidence checks. For code-change agents.
 * - browser : Includes repo + config write approval. For agents that need to mutate project settings.
 * - graph   : Includes repo + full graph query and memory write. For ontology-heavy analysis agents.
 *
 * Profiles are enforced for write-capable omk-project MCP tools. Default sessions expose
 * read-only tools only; trusted local sessions can opt into docs/repo/browser/graph.
 */
