I am building a private macOS account-observation application for my own Zerodha retail account.
The application should only read holdings, positions, margins, profile, current-day orders and trades. It must have **no authority to place, modify, cancel or trigger any trades, including GTT orders**.
Before introducing authentication, I would appreciate clarification on the following:
1. **Read-only credentials:** Can ordinary retail Personal or paid Kite Connect applications obtain an API key or access token with broker-enforced read-only permissions? Can all order, GTT and other account-modifying operations be disabled?
2. **Alternative access:** If not, does Zerodha provide any officially supported account-observation interface or credential for individual developers?
3. **Kite MCP:** Your product page describes MCP as read-only, while your support documentation mentions GTT order functionality. Can GTT and every other write-capable tool be disabled at the provider level? Is MCP supported for integration into privately developed applications?
4. **Desktop authentication:** Is there a secure, officially supported authentication mechanism for a private macOS application that avoids embedding or exposing a trading-capable API secret?
5. **Data completeness:** Are orders and trades limited to the current trading day? Is historical execution and complete cash/fee information available through an officially supported read-only mechanism? Are there guarantees around capture completeness or consistent account-state timestamps?
6. **Security verification:** Can Zerodha provide an authoritative permission matrix or configuration confirmation so read-only enforcement can be verified without attempting an actual trade?
I am specifically seeking **server-side permission enforcement**, not merely an application that voluntarily avoids write endpoints.
The integration remains offline until the security model is clarified.
