diff --git a/.gitea/workflows/ci-cd.yml b/.gitea/workflows/ci-cd.yml
index f21055528..1fa0e4d4c 100755
--- a/.gitea/workflows/ci-cd.yml
+++ b/.gitea/workflows/ci-cd.yml
@@ -103,7 +103,7 @@ jobs:
     - name: Type check (mypy, advisory mode)
       if: always()
       shell: sh
-      run: "set +e\necho \"=== Installing mypy ===\"\npython3 -m pip install -q mypy\nmypy --version\necho \"\"\necho \"=== Running mypy type check (advisory mode) ===\"\necho \"告警模式，不阻断CI\"\necho \"\"\n# 只检查核心业务代码，跳过测试和迁移\nEXIT_CODE=0\nmypy apps/api/app packages             --ignore-missing-imports             --no-site-packages             --no-strict-optional             --explicit-package-bases             --exclude 'tests/|test_|migrations/|alembic/'             --no-error-summary             2>&1 | head -60 || EXIT_CODE=$?\necho \"\"\nif [ \"$EXIT_CODE\" != \"0\" ]; then\n  echo \"mypy 发现类型问题（告警模式，不阻断）\"\n  echo \"建议后续逐步修复\"\nelse\n  echo \"mypy 类型检查通过 ✅\"\nfi\nexit 0\n"
+      run: "bash scripts/ci/mypy_check.sh"
     - name: Run security scan (bandit)
       shell: sh
       run: 'set -eu
diff --git a/pyproject.toml b/pyproject.toml
index 00d33b71f..06003dc3b 100755
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -63,6 +63,7 @@ exclude = [
   ".next",
   "dist",
   "build",
+  "hostexecutor",
 ]
 
 [tool.ruff.lint]
diff --git a/scripts/ci/mypy_check.sh b/scripts/ci/mypy_check.sh
new file mode 100644
index 000000000..fbff371eb
--- /dev/null
+++ b/scripts/ci/mypy_check.sh
@@ -0,0 +1,48 @@
+#!/bin/bash
+# mypy增量扫描脚本 - CI中调用
+# 环境变量: SCAN_MODE, CHANGED_PY_FILES
+
+set +e
+
+echo "=== Installing mypy ==="
+python3 -m pip install -q mypy
+mypy --version
+echo ""
+echo "=== Running mypy type check (advisory mode) ==="
+echo "告警模式，��阻断CI"
+echo ""
+
+MYPY_COMMON_ARGS="--ignore-missing-imports --no-site-packages --no-strict-optional --explicit-package-bases --exclude tests/|test_|migrations/|alembic/ --no-error-summary --incremental --cache-dir .mypy_cache"
+
+EXIT_CODE=0
+
+if [ "$SCAN_MODE" = "incremental" ] && [ -n "$CHANGED_PY_FILES" ]; then
+  echo "=== Incremental mypy scan (PR mode) ==="
+  echo "Changed files: $(echo $CHANGED_PY_FILES | wc -w) files"
+  MYPY_FILES=""
+  for f in $CHANGED_PY_FILES; do
+    case "$f" in
+      apps/*|packages/*)
+        MYPY_FILES="$MYPY_FILES $f"
+        ;;
+    esac
+  done
+  if [ -n "$MYPY_FILES" ]; then
+    echo "Checking: $MYPY_FILES"
+    mypy $MYPY_FILES $MYPY_COMMON_ARGS 2>&1 | head -80 || EXIT_CODE=$?
+  else
+    echo "No mypy-checkable files changed, skipping"
+  fi
+else
+  echo "=== Full mypy scan ==="
+  mypy apps/api/app packages $MYPY_COMMON_ARGS 2>&1 | head -60 || EXIT_CODE=$?
+fi
+
+echo ""
+if [ "$EXIT_CODE" != "0" ]; then
+  echo "mypy 发现类型问题（告警模式，��阻断）"
+  echo "建议后续逐步修复"
+else
+  echo "mypy 类型检查通过"
+fi
+exit 0