diff --git a/apps/web/src/app/layout.tsx b/apps/web/src/app/layout.tsx
index 9a4eef1a..210dd0ae 100644
--- a/apps/web/src/app/layout.tsx
+++ b/apps/web/src/app/layout.tsx
@@ -142,6 +142,19 @@ export default async function RootLayout({ children }: { children: React.ReactNo
 
   return (
     <html lang={locale} dir={dir} suppressHydrationWarning>
+      <head>
+        {/* WebMCP (@profullstack/webmcp): site_info and open_page for the AI agent in the
+            visitor's browser. No-op where the browser has no WebMCP. type="module" is
+            already deferred, which this rule does not know. */}
+        {/* eslint-disable-next-line @next/next/no-sync-scripts */}
+        <script
+          type="module"
+          nonce={nonce}
+          data-webmcp=""
+          src="https://cdn.jsdelivr.net/npm/@profullstack/webmcp@0/src/embed.js"
+          data-pages='{"features":"/features","pricing":"/pricing","download":"/download","docs":"/docs","use_cases":"/use-cases","channels":"/channels","blog":"/blog"}'
+        />
+      </head>
       <body className="min-h-screen font-sans">
         <NextIntlClientProvider>
           <script
diff --git a/apps/web/src/middleware.ts b/apps/web/src/middleware.ts
index 8c4dba1d..d41fdf40 100644
--- a/apps/web/src/middleware.ts
+++ b/apps/web/src/middleware.ts
@@ -30,7 +30,7 @@ function mediaOrigin(): string {
 function buildCsp(nonce: string, embeddable: boolean): string {
   return [
     "default-src 'self'",
-    `script-src 'self' 'nonce-${nonce}' 'wasm-unsafe-eval' https://crawlproof.com https://datafa.st`,
+    `script-src 'self' 'nonce-${nonce}' 'wasm-unsafe-eval' https://crawlproof.com https://datafa.st https://cdn.jsdelivr.net`,
     "style-src 'self' 'unsafe-inline'",
     "img-src 'self' data: blob: https:",
     `media-src 'self' blob: ${mediaOrigin()}`,