diff --git a/docs/network.md b/docs/network.md
index 6d8ff7417..d11572d89 100644
--- a/docs/network.md
+++ b/docs/network.md
@@ -131,7 +131,7 @@ not found" failure mode.
   agent on that runner needs `az`) or to install `azure-cli` on the
   runner image.
 
-See [`docs/tools.md`](tools.md#built-in-clis) for the agent-facing
+See [`docs/tools.md`](tools.md#host-provided-clis) for the agent-facing
 contract (auth scope, available subcommands).
 
 ## Renewable Azure authentication for MCP servers
diff --git a/docs/tools.md b/docs/tools.md
index cc3b607d3..c814ed9c7 100644
--- a/docs/tools.md
+++ b/docs/tools.md
@@ -161,10 +161,10 @@ subcommands. When configured, use `tools.azure-devops` for authenticated ADO
 reads. Do not run `az login` or inject Azure credentials into the Agent
 sandbox; use SafeOutputs or request a supported tool instead.
 
-A daily smoke pipeline at
-[`tests/safe-outputs/azure-cli.md`](../tests/safe-outputs/azure-cli.md)
-exercises binary/subcommand availability without claiming authenticated direct
-ADO access.
+A smoke pipeline at
+[`tests/smoke/ado-proxy.md`](../tests/smoke/ado-proxy.md)
+exercises the wrapped `az` path (`az devops`, `az rest`) against the
+credential-isolated proxy without claiming unauthenticated direct ADO access.
 
 ### GitHub CLI (`gh`)