/**
 * MCP Config Scanner
 *
 * Scans MCP server configuration files for:
 *   - Known-vulnerable MCP servers (e.g., mcp-remote CVE-2025-6514)
 *   - Suspicious server configurations (external URLs, unknown servers)
 *   - Servers with overly permissive permissions
 */
import type { ScannerResult } from './types.js';
export interface DiscoveredMcpServer {
    /** Server key from the config (e.g. "memory", "github") */
    name: string;
    /** Config file this server was discovered in */
    source: string;
    /** Config file path */
    sourcePath: string;
    /** Executable to spawn */
    command: string;
    /** Arguments passed to the command */
    args: string[];
    /** Extra environment variables for the child */
    env: Record<string, string>;
}
/**
 * Discover all configured, locally-spawnable (stdio) MCP servers across every
 * known config location. Reuses `getConfigLocations()` + `extractServers()` so
 * path logic lives in exactly one place.
 *
 * Servers are de-duplicated by name (first config wins) so the same logical
 * server defined in both a global and project config isn't scanned twice.
 */
export declare function discoverMcpServers(): DiscoveredMcpServer[];
/**
 * Run the MCP config scanner.
 */
export declare function scanMcpConfigs(): ScannerResult;
