diff --git a/Dockerfile b/Dockerfile
index 4bac763..58190a1 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -83,6 +83,7 @@ ARG CAVEMAN_VERSION=latest
 ARG AZURE_FOUNDRY_PROVIDER_REF=latest
 ARG PONYTAIL_VERSION=latest
 ARG ENGRAM_VERSION=latest
+ARG GRAPHIFY_VERSION=latest
 ARG OPENCODE_BUILD_DIR=/usr/local/share/opencode-build
 
 ENV OPENCODE_CONFIG_DIR=/etc/opencode
@@ -267,6 +268,45 @@ grep -qF './ponytail/hooks/' "${OPENCODE_CONFIG_DIR}/plugins/ponytail.mjs" \
   curl -fsSL "${PONYTAIL_RAW_BASE}/skills/ponytail-help/SKILL.md" -o "${OPENCODE_CONFIG_DIR}/skills/ponytail-help/SKILL.md"
 } & wait || exit 1
 
+###
+# graphify
+#
+graphify_resolved_version=$(resolve_github_latest_version "Graphify-Labs/graphify" "${GRAPHIFY_VERSION}") || exit 1
+echo "GRAPHIFY_RESOLVED_REF=${graphify_resolved_version}"
+
+uv pip install --system graphifyy[pdf,office,svg,openai,azure,sql,postgres,terraform] || exit 1
+
+# Install graphify for opencode into a temp project dir — uses install.py's
+# own _copy_skill_file + _install_opencode_plugin logic so the SKILL.md,
+# references/ sidecar, .graphify_version stamp, and graphify.js plugin are
+# all laid down correctly by graphify itself, not reconstructed here.
+TMP_GRAPHIFY=/tmp/graphify-install
+mkdir -p "$TMP_GRAPHIFY"
+( cd "$TMP_GRAPHIFY" && graphify install --project --platform opencode ) || exit 1
+
+# Move installed artifacts to system opencode dir
+cp -r "$TMP_GRAPHIFY/.opencode/skills/graphify" "${OPENCODE_CONFIG_DIR}/skills/graphify"
+cp "$TMP_GRAPHIFY/.opencode/plugins/graphify.js" "${OPENCODE_CONFIG_DIR}/plugins/graphify.js"
+
+rm -rf "$TMP_GRAPHIFY"
+
+# Append graphify always-on section to AGENTS.md
+cat >> "${OPENCODE_CONFIG_DIR}/AGENTS.md" <<-'AGENTS_GRAPHIFY'
+
+## graphify
+
+This project has a knowledge graph at graphify-out/ with god nodes, community structure, and cross-file relationships.
+
+When the user types `/graphify`, use the installed graphify skill or instructions before doing anything else.
+
+Rules:
+- For codebase questions, first run `graphify query "<question>"` when graphify-out/graph.json exists. Use `graphify path "<A>" "<B>"` for relationships and `graphify explain "<concept>"` for focused concepts. These return a scoped subgraph, usually much smaller than GRAPH_REPORT.md or raw grep output.
+- Dirty graphify-out/ files are expected after hooks or incremental updates; dirty graph files are not a reason to skip graphify. Only skip graphify if the task is about stale or incorrect graph output, or the user explicitly says not to use it.
+- If graphify-out/wiki/index.md exists, use it for broad navigation instead of raw source browsing.
+- Read graphify-out/GRAPH_REPORT.md only for broad architecture review or when query/path/explain do not surface enough context.
+- After modifying code, run `graphify update .` to keep the graph current (AST-only, no API cost).
+AGENTS_GRAPHIFY
+
 ###
 # cleanup
 rm -rf /root/.bun
@@ -293,7 +333,8 @@ cat >"${OPENCODE_CONFIG_DIR}/opencode.json" <<-'EOF'
   "autoupdate": false,
   "plugin": [
     "file:///usr/local/bun/install/global/node_modules/opencode-gemini-auth",
-    "file:///etc/opencode/plugins/caveman"
+    "file:///etc/opencode/plugins/caveman",
+    "file:///etc/opencode/plugins/graphify.js"
   ],
   "mcp": {
     "engram": {
@@ -303,7 +344,7 @@ cat >"${OPENCODE_CONFIG_DIR}/opencode.json" <<-'EOF'
         "mcp",
         "--tools=agent"
       ],
-      "enabled": true
+      "enabled": false
     },
     "sequential-thinking": {
       "type": "local",
diff --git a/Makefile b/Makefile
index 8a77a8b..354c3e4 100644
--- a/Makefile
+++ b/Makefile
@@ -17,6 +17,13 @@ build:
 		--build-arg AZURE_FOUNDRY_PROVIDER_REF=$(AZURE_FOUNDRY_PROVIDER_REF) \
 		$(CONTEXT)
 
+run:
+	@- docker run \
+		--rm \
+		-ti \
+		--entrypoint bash \
+		$(IMAGE_REF)
+
 clean:
 	@echo "Removing image $(IMAGE_REF) if it exists..."
 	- docker image inspect $(IMAGE_REF) >/dev/null 2>&1 && docker rmi $(IMAGE_REF) || true
diff --git a/README.md b/README.md
index 2019ee5..85778b3 100644
--- a/README.md
+++ b/README.md
@@ -333,21 +333,22 @@ opencodec
 
 The build bundles these tools and skills:
 
-- `opencode-ai`
-- `mise`
+- [`opencode-ai`](https://opencode.ai/)
+- [`mise`](https://mise.jdx.dev/)
 - shell bootstrap for interactive and non-interactive command execution
 - default OpenCode configuration under `/etc/opencode`
-- `engram` for persisted memory-oriented workflows
-- `aleph` tooling for large-context local analysis workflows
+- [`engram`](https://github.com/Gentleman-Programming/engram) — persisted memory-oriented workflows
+- [`aleph`](https://github.com/Hmbown/aleph) — large-context local analysis workflows
 - local MCP-backed integrations available by default
-- `python`
-- `go`
-- `ripgrep`
-- `uv`
-- `git`
+- [`python`](https://python.org)
+- [`go`](https://go.dev)
+- [`ripgrep`](https://github.com/BurntSushi/ripgrep)
+- [`uv`](https://docs.astral.sh/uv/)
+- [`git`](https://git-scm.com)
+- [`graphify`](https://github.com/Graphify-Labs/graphify) — knowledge graph for codebase architecture
 - `sudo`, `curl`, `gpg`, `make`
-- Azure Foundry provider build output
-- OpenCode skills for `stop-slop`, `aleph`, and changelog automation
+- [Azure Foundry provider](https://github.com/ophiosdev/azure-foundry-provider) build output
+- OpenCode skills for [`stop-slop`](https://github.com/hardikpandya/stop-slop), `aleph`, `graphify`, and changelog automation
 
 The repository also includes `git-export.ts`, a Bun helper script that exports a single directory from
 a GitHub repository using a treeless, sparse clone workflow.
@@ -362,7 +363,7 @@ This repo publishes container images to GitHub Container Registry from version t
 
 ## Repository Structure
 
-- `Dockerfile`: Builds the OpenCode container image and installs providers, tools, and skills
+- `Dockerfile`: Builds the OpenCode container image, generates default `opencode.json` config and AGENTS.md, and installs providers, tools, and skills
 - `entrypoint.sh`: Loads shell environment and starts `opencode`
 - `git-export.ts`: Sparse GitHub directory export helper
 - `Makefile`: Convenience targets for local image build and cleanup
@@ -402,6 +403,6 @@ test when `Dockerfile` changes.
 
 ### Build and Runtime Issues
 
-- Build failures fetching dependencies: verify network access to npm, GitHub, and other upstream sources used in the Docker build
+- Build failures fetching dependencies: verify network access to `npm`, GitHub, and other upstream sources used in the Docker build
 - Provider or skill changes upstream: rebuild the image to refresh fetched components
 - Command invocation errors: place OpenCode arguments after the image name and use `--help` to confirm supported flags