/**
 * Tool Response Scanner
 *
 * Defence scanner for MCP tool outputs (read-path). Tool output is the #1 MCP
 * attack surface, so the read path shares the WRITE-path detection surface
 * instead of running a thinner pattern set:
 *
 *   - scanForInjection   — Iron Dome regex set (named-pattern reporting)
 *   - detectInstructions — write-path instruction detector; folds cross-script
 *                          homoglyphs and scans in windows (catches `ignorе …`)
 *   - detectEncoding     — write-path encoding detector; decodes base64/hex/url
 *                          blobs so a BARE blob that decodes to an injection is
 *                          re-scanned on the plaintext (decode-and-rescan)
 *   - detectMarkdownImageExfil — markdown image whose URL smuggles data out
 *   - scanForCredentials — credential leak scanning (retained)
 *
 * It deliberately does NOT pull in the write-path's trust scoring, anomaly,
 * privilege, fragmentation or sensitivity layers — those are write concerns.
 *
 * Advisory by default: logs threats but never blocks tool responses. Only the
 * audit/event firewall_result reflects enforce mode; the scan itself never hard
 * blocks tool execution.
 */
import type { ToolResponseScanResult } from './types.js';
/**
 * Check if a tool's response should be scanned.
 * Unknown tools (e.g. external MCP servers) default to scanned.
 */
export declare function shouldScanToolResponse(toolName: string): boolean;
/**
 * Scan a tool response for threats.
 *
 * Shares the write-path detection surface: Iron Dome injection patterns,
 * instruction detection (with homoglyph folding + windowed scanning), encoding
 * decode-and-rescan, markdown-image exfiltration, and credential leak detection.
 * In advisory mode, threats are logged but the response is never blocked.
 */
export declare function scanToolResponse(toolName: string, content: string, mode?: 'advisory' | 'enforce'): ToolResponseScanResult;
