I’m testing Claude with an MCP server that exposes several tools, but I only want it to be able to read records—not create or update them. Can permissions be restricted per tool or action, or does the approval flow treat access to the server as all-or-nothing?

I’m especially interested in how people handle this when a server offers both read-only and write operations.