diff --git a/mcp/server.ts b/mcp/server.ts
index 3e58c28..71d41a1 100644
--- a/mcp/server.ts
+++ b/mcp/server.ts
@@ -125,7 +125,7 @@ function buildCommonTools(ctx: ToolContext, outputSchema?: JsonSchema): Tool<any
     tools.push(SetOutputTool(ctx, outputSchema));
   }
 
-  if (ctx.payload.shell === "restricted") {
+  if (ctx.payload.shell !== "disabled") {
     tools.push(ShellTool(ctx));
     tools.push(KillBackgroundTool(ctx));
   }
diff --git a/utils/instructions.ts b/utils/instructions.ts
index 12d61c4..83a72c7 100644
--- a/utils/instructions.ts
+++ b/utils/instructions.ts
@@ -99,7 +99,7 @@ function getShellInstructions(
     case "restricted":
       return `### Shell commands\n\nUse the \`${t("shell")}\` MCP tool for all shell command execution. This tool provides a secure environment with filtered credentials. Do NOT use any native shell tool — it is disabled for security. For long-running processes, use \`shell({ command, background: true })\`. Use \`${t("kill_background")}\` to stop background processes.`;
     case "enabled":
-      return `### Shell commands\n\nUse your native shell tool for shell command execution.`;
+      return `### Shell commands\n\nUse the \`${t("shell")}\` MCP tool for all shell command execution (unrestricted environment, credentials available).`;
     default: {
       const _exhaustive: never = shell;
       return _exhaustive satisfies never;