diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b04f1cd..ce05c7f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -17,6 +17,27 @@ permissions:
   contents: read
 
 jobs:
+  # Cheap gate so docs-only/roadmap PRs skip the heavyweight jobs. Skipped
+  # required checks still satisfy branch protection ("skipped" = success).
+  changes:
+    name: Changed paths
+    runs-on: ubuntu-latest
+    outputs:
+      code: ${{ steps.filter.outputs.code }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dorny/paths-filter@v3
+        id: filter
+        with:
+          filters: |
+            code:
+              - 'app/**'
+              - 'infra/**'
+              - 'docker-compose.yml'
+              - 'install.sh'
+              - '.github/workflows/**'
+              - 'docs/api/**'
+
   infra:
     name: Infra (Compose + Scripts)
     runs-on: ubuntu-latest
@@ -48,6 +69,8 @@ jobs:
   backend:
     name: Backend (Go)
     runs-on: ubuntu-latest
+    needs: changes
+    if: needs.changes.outputs.code == 'true' || github.event_name != 'pull_request'
     defaults:
       run:
         working-directory: app/backend
@@ -70,6 +93,8 @@ jobs:
   frontend:
     name: Frontend (React)
     runs-on: ubuntu-latest
+    needs: changes
+    if: needs.changes.outputs.code == 'true' || github.event_name != 'pull_request'
     defaults:
       run:
         working-directory: app/frontend
@@ -100,6 +125,8 @@ jobs:
     name: Compose boot smoke
     runs-on: ubuntu-latest
     timeout-minutes: 20
+    needs: changes
+    if: needs.changes.outputs.code == 'true' || github.event_name != 'pull_request'
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -137,6 +164,7 @@ jobs:
     name: Build & publish images
     runs-on: ubuntu-latest
     needs: [backend, frontend, smoke]
+    if: needs.backend.result == 'success' && needs.frontend.result == 'success' && needs.smoke.result == 'success'
     permissions:
       contents: read
       packages: write
@@ -227,7 +255,7 @@ jobs:
     name: Release
     runs-on: ubuntu-latest
     needs: [docker]
-    if: github.event_name != 'pull_request'
+    if: github.event_name != 'pull_request' && needs.docker.result == 'success'
     permissions:
       contents: write
       packages: write
diff --git a/scripts/build-cli.sh b/scripts/build-cli.sh
index a3978aa..cd921e0 100755
--- a/scripts/build-cli.sh
+++ b/scripts/build-cli.sh
@@ -21,18 +21,25 @@ for platform in $PLATFORMS; do
     GOARCH=${platform#*/}
     
     OUTPUT_NAME="containr-${GOOS}-${GOARCH}"
+    MCP_NAME="containr-mcp-${GOOS}-${GOARCH}"
     if [ "$GOOS" = "windows" ]; then
         OUTPUT_NAME="${OUTPUT_NAME}.exe"
+        MCP_NAME="${MCP_NAME}.exe"
     fi
     
-    echo "📦 Building for ${platform}..."
-    
+    echo "📦 Building CLI for ${platform}..."
     GOOS=$GOOS GOARCH=$GOARCH go build \
         -ldflags "$LDFLAGS" \
         -o "bin/${OUTPUT_NAME}" \
         ./cmd/cli
     
-    echo "✅ Built bin/${OUTPUT_NAME}"
+    echo "📦 Building MCP server for ${platform}..."
+    GOOS=$GOOS GOARCH=$GOARCH go build \
+        -ldflags "$LDFLAGS" \
+        -o "bin/${MCP_NAME}" \
+        ./cmd/mcp
+    
+    echo "✅ Built bin/${OUTPUT_NAME} + bin/${MCP_NAME}"
 done
 
 echo "🎉 CLI build complete!"