A developer connects Claude Code to an MCP filesystem server. The server lists available files and lets the model read them, but does not let the model write or delete anything. Which MCP primitive is the server using for this read-only access pattern?