Check if this issue is valid — if so, understand the root cause and fix it. At src/mcp/index.ts, line 35:

<comment>Workspace-local config can supply `code_graph_context.binary_path`, which is used as an executed local MCP command, enabling arbitrary code execution from untrusted repos.</comment>

<file context>
@@ -28,5 +31,12 @@ export function createBuiltinMcps(disabledMcps: string[] = [], config?: OhMyOpen
   }
 
+  if (!disabledMcps.includes("code_graph_context")) {
+    const cgcConfig = createCodeGraphContextConfig(config?.code_graph_context)
+    if (cgcConfig) {
+      mcps.code_graph_context = cgcConfig
</file context>

Check if this issue is valid — if so, understand the root cause and fix it. At src/cli/doctor/checks/tools-mcp.ts, line 8:

<comment>Doctor MCP check now treats `code_graph_context` as always enabled by adding it to a static built-in list that is mapped to `enabled: true`, ignoring its conditional config-based enablement.</comment>

<file context>
@@ -5,7 +5,7 @@ import { join } from "node:path"
 import { parseJsonc } from "../../../shared"
 
-const BUILTIN_MCP_SERVERS = ["context7", "grep_app"]
+const BUILTIN_MCP_SERVERS = ["context7", "grep_app", "code_graph_context"]
 
 interface McpConfigShape {
</file context>

Check if this issue is valid — if so, understand the root cause and fix it. At src/mcp/index.test.ts, line 133:

<comment>The new filtering test for `code_graph_context` is vacuous because the MCP is disabled by default, so the assertion passes regardless of whether disabled-list filtering works.</comment>

<file context>
@@ -103,4 +103,36 @@ describe("createBuiltinMcps", () => {
+    const disabledMcps = ["code_graph_context"]
+
+    // when
+    const result = createBuiltinMcps(disabledMcps)
+
+    // then
</file context>

Check if this issue is valid — if so, understand the root cause and fix it. At src/mcp/code-graph-context.ts, line 15:

<comment>Windows auto-detection is broken because binary lookup uses `cgc` instead of `cgc.exe` for path probes.</comment>

<file context>
@@ -0,0 +1,76 @@
+}
+
+const COMMON_BINARY_LOCATIONS = [
+  join(homedir(), ".local", "bin", "cgc"),
+  "/usr/local/bin/cgc",
+  "/usr/bin/cgc",
</file context>

Check if this issue is valid — if so, understand the root cause and fix it. At src/mcp/code-graph-context.ts, line 22:

<comment>`binary_path` validation incorrectly rejects PATH-resolved command names (e.g., `cgc`), causing valid MCP setups to be disabled.</comment>

<file context>
@@ -0,0 +1,76 @@
+
+function findCgcBinary(overridePath?: string): string | undefined {
+  if (overridePath) {
+    return existsSync(overridePath) ? overridePath : undefined
+  }
+
</file context>

Check if this issue is valid — if so, understand the root cause and fix it. At src/mcp/code-graph-context.test.ts, line 26:

<comment>Auto-detection branch (`enabled: true` without `binary_path`) is untested, leaving the core fallback binary resolution path unverified.</comment>

<file context>
@@ -0,0 +1,69 @@
+    })
+  })
+
+  describe("#given config is enabled", () => {
+    test("#when binary_path points to nonexistent file #then returns undefined", () => {
+      // given
</file context>