From 7fd871bae0685500b0cb748aa31d86aa3e19362b Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@profullstack.com>
Date: Wed, 11 Nov 2026 08:08:41 +0000
Subject: [PATCH 1/2] feat(web): WebMCP tools via @profullstack/webmcp

Adds @profullstack/webmcp so in-browser AI agents get the site's tools.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/web/src/app/layout.tsx | 11 +++++++++++
 apps/web/src/middleware.ts  |  2 +-
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/apps/web/src/app/layout.tsx b/apps/web/src/app/layout.tsx
index 9a4eef1a..8cca3217 100644
--- a/apps/web/src/app/layout.tsx
+++ b/apps/web/src/app/layout.tsx
@@ -142,6 +142,17 @@ export default async function RootLayout({ children }: { children: React.ReactNo
 
   return (
     <html lang={locale} dir={dir} suppressHydrationWarning>
+      <head>
+        {/* WebMCP (@profullstack/webmcp): site_info and open_page for the AI agent in the
+            visitor's browser. No-op where the browser has no WebMCP. */}
+        <script
+          type="module"
+          nonce={nonce}
+          data-webmcp=""
+          src="https://cdn.jsdelivr.net/npm/@profullstack/webmcp@0/src/embed.js"
+          data-pages='{"features":"/features","pricing":"/pricing","download":"/download","docs":"/docs","use_cases":"/use-cases","channels":"/channels","blog":"/blog"}'
+        />
+      </head>
       <body className="min-h-screen font-sans">
         <NextIntlClientProvider>
           <script
diff --git a/apps/web/src/middleware.ts b/apps/web/src/middleware.ts
index 8c4dba1d..d41fdf40 100644
--- a/apps/web/src/middleware.ts
+++ b/apps/web/src/middleware.ts
@@ -30,7 +30,7 @@ function mediaOrigin(): string {
 function buildCsp(nonce: string, embeddable: boolean): string {
   return [
     "default-src 'self'",
-    `script-src 'self' 'nonce-${nonce}' 'wasm-unsafe-eval' https://crawlproof.com https://datafa.st`,
+    `script-src 'self' 'nonce-${nonce}' 'wasm-unsafe-eval' https://crawlproof.com https://datafa.st https://cdn.jsdelivr.net`,
     "style-src 'self' 'unsafe-inline'",
     "img-src 'self' data: blob: https:",
     `media-src 'self' blob: ${mediaOrigin()}`,

From 39b051f749b1ed365c28f4cc18f77300f1975545 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@profullstack.com>
Date: Wed, 11 Nov 2026 09:48:11 +0000
Subject: [PATCH 2/2] fix(web): lint: module script is deferred
 (no-sync-scripts)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/web/src/app/layout.tsx | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/apps/web/src/app/layout.tsx b/apps/web/src/app/layout.tsx
index 8cca3217..210dd0ae 100644
--- a/apps/web/src/app/layout.tsx
+++ b/apps/web/src/app/layout.tsx
@@ -144,7 +144,9 @@ export default async function RootLayout({ children }: { children: React.ReactNo
     <html lang={locale} dir={dir} suppressHydrationWarning>
       <head>
         {/* WebMCP (@profullstack/webmcp): site_info and open_page for the AI agent in the
-            visitor's browser. No-op where the browser has no WebMCP. */}
+            visitor's browser. No-op where the browser has no WebMCP. type="module" is
+            already deferred, which this rule does not know. */}
+        {/* eslint-disable-next-line @next/next/no-sync-scripts */}
         <script
           type="module"
           nonce={nonce}