diff --git a/pkg/workflow/mcp_setup_generator.go b/pkg/workflow/mcp_setup_generator.go
index f0d8e34b3a2..8560b52d5f9 100644
--- a/pkg/workflow/mcp_setup_generator.go
+++ b/pkg/workflow/mcp_setup_generator.go
@@ -91,15 +91,14 @@ func (c *Compiler) generateMCPSetup(yaml *strings.Builder, tools map[string]any,
 		if toolValue == false {
 			continue
 		}
+		// When cli-proxy is enabled, agents use the pre-authenticated gh CLI for GitHub
+		// reads instead of the GitHub MCP server. Skip so it is not configured with the gateway.
+		if toolName == "github" && isFeatureEnabled(constants.CliProxyFeatureFlag, workflowData) {
+			mcpSetupGeneratorLog.Print("Skipping GitHub MCP server registration: cli-proxy feature flag is enabled")
+			continue
+		}
 		// Standard MCP tools
 		if toolName == "github" || toolName == "playwright" || toolName == "cache-memory" || toolName == "agentic-workflows" {
-			// When cli-proxy is enabled, agents use the pre-authenticated gh CLI for GitHub
-			// reads instead of the GitHub MCP server. Skip registering the GitHub MCP server
-			// so it is not configured with the gateway.
-			if toolName == "github" && isFeatureEnabled(constants.CliProxyFeatureFlag, workflowData) {
-				mcpSetupGeneratorLog.Print("Skipping GitHub MCP server registration: cli-proxy feature flag is enabled")
-				continue
-			}
 			mcpTools = append(mcpTools, toolName)
 		} else if mcpConfig, ok := toolValue.(map[string]any); ok {
 			// Check if it's explicitly marked as MCP type in the new format
diff --git a/pkg/workflow/unified_prompt_step.go b/pkg/workflow/unified_prompt_step.go
index 90b398a735e..06e9123d44a 100644
--- a/pkg/workflow/unified_prompt_step.go
+++ b/pkg/workflow/unified_prompt_step.go
@@ -224,7 +224,7 @@ func (c *Compiler) collectPromptSections(data *WorkflowData) []PromptSection {
 		}
 	}
 
-	// 9b. GitHub tool-use guidance: directs the model to the correct mechanism for
+	// 10. GitHub tool-use guidance: directs the model to the correct mechanism for
 	// GitHub reads (and writes when safe-outputs is also enabled).
 	// When cli-proxy is enabled, the agent uses the pre-authenticated gh CLI for reads
 	// instead of a GitHub MCP server (which is not registered). Otherwise, the GitHub
@@ -255,7 +255,7 @@ func (c *Compiler) collectPromptSections(data *WorkflowData) []PromptSection {
 		})
 	}
 
-	// 10. PR context (if comment-related triggers and checkout is needed)
+	// 11. PR context (if comment-related triggers and checkout is needed)
 	hasCommentTriggers := c.hasCommentRelatedTriggers(data)
 	needsCheckout := c.shouldAddCheckoutStep(data)
 	permParser := NewPermissionsParser(data.Permissions)