diff --git a/config/source/skills/cloud-functions/SKILL.md b/config/source/skills/cloud-functions/SKILL.md
index 36acedd3..4264ff93 100644
--- a/config/source/skills/cloud-functions/SKILL.md
+++ b/config/source/skills/cloud-functions/SKILL.md
@@ -118,8 +118,11 @@ Use these rules whenever you are writing the function code itself:
 3. **Write code and deploy, do not stop at local files**
    - Use `manageFunctions(action="createFunction")` for creation
    - Use `manageFunctions(action="updateFunctionCode")` for code updates
+   - Use `manageFunctions(action="updateFunctionConfig")` for config updates (timeout, memorySize, envVariables)
    - Keep `functionRootPath` as the directory that directly contains function folders (e.g., `cloudfunctions/` or `functions/`), NOT the project root and NOT the function subdirectory itself
-   - Use CLI only as a fallback when MCP tools are unavailable
+   - **Prefer MCP tools over CLI** — when MCP tools are available, use `manageFunctions` and `queryFunctions` instead of CLI commands
+   - **Do NOT use CLI when it is explicitly disabled** — if the runtime indicates CLI is unavailable, use MCP tools exclusively
+   - For batch updates (multiple functions), call `manageFunctions(action="updateFunctionConfig")` individually for each function — MCP does not have a `--all` batch parameter like CLI
 
 4. **Prefer doc-first fallbacks**
    - If a task falls back to `callCloudApi`, first check the official docs or knowledge-base entry for that action
diff --git a/config/source/skills/cloud-functions/references/operations-and-config.md b/config/source/skills/cloud-functions/references/operations-and-config.md
index f6ef3000..55ecdf23 100644
--- a/config/source/skills/cloud-functions/references/operations-and-config.md
+++ b/config/source/skills/cloud-functions/references/operations-and-config.md
@@ -156,11 +156,16 @@ Prefer the converged entrances below, but translate historical names when they a
 
 ## CLI fallback
 
-Use CLI only when MCP tools are unavailable.
+Use CLI **only** when MCP tools are unavailable AND CLI is explicitly enabled in the runtime environment.
 
 - `tcb fn deploy <name>` -> Event Function
 - `tcb fn deploy <name> --httpFn` -> HTTP Function
 - `tcb fn deploy <name> --httpFn --ws` -> HTTP Function with WebSocket
 - `tcb fn deploy --all` -> Deploy all functions
+- `tcb fn config update <name>` -> Update function config (timeout, memorySize, envVariables)
+
+**Important:** When the runtime indicates CLI is disabled (e.g., `tcbCliEnabled: false`), use MCP tools exclusively. Do not attempt CLI commands in such environments.
+
+**Batch updates via MCP:** MCP does not have a `--all` batch parameter. To update multiple functions, call `manageFunctions(action="updateFunctionConfig")` individually for each function.
 
 In non-interactive agent runs, do not default to CLI login or interactive setup flows.