I’m looking at connecting Claude to an MCP server that can access internal project data. For our first trial, I’d like Claude to inspect records but not create, update, or delete anything.

Can a tool’s permissions be limited to read-only access at the MCP server or client level, and does that restriction remain in place across sessions? I’m curious what controls people have actually tested, rather than relying on a prompt that simply asks the model not to make changes.