Content-Security-Policy: default-src 'self'; base-uri 'self' https://*.run.mcp-use.com; form-action 'self'; object-src 'none'; frame-ancestors 'none'; upgrade-insecure-requests; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://static.intercomcdn.com https://js.intercomcdn.com https://widget.intercom.io https://ddwl4m2hdecbv.cloudfront.net https://*.posthog.com https://*.i.posthog.com https://badges.oneleet.com https://cdn.mcp-use.com https://app.useitem.io https://b.manufact.com https://static.cloudflareinsights.com https://vercel.live https://va.vercel-scripts.com https://app.cal.com https://www.googletagmanager.com https://googleads.g.doubleclick.net https://*.run.mcp-use.com https://cdn.jsdelivr.net; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: blob: https:; media-src 'self' blob: https:; font-src 'self' data: https:; connect-src 'self' blob: https: wss: ws: https://cloud.manufact.com; worker-src 'self' blob: https://*.run.mcp-use.com https://cdn.jsdelivr.net; child-src 'self' blob:; frame-src 'self' https:; manifest-src 'self'