Website Technology Detector: Tech Stack Scanner

Detect what technology any website runs on — CMS, web framework, JavaScript libraries, ecommerce platform, analytics and tag managers, web server, CDN, hosting, and marketing pixels — from a single URL. A structured technology lookup, built as an MCP tool an agent can call directly.

What it does

Fetches a single public page — the URL you give it, plus whatever redirect it issues — and matches its HTTP response headers, cookies, HTML markup, meta tags and

No headless browser: it is a plain, fast HTTP fetch, which is exactly why it is cheap enough to run in bulk.

Who it's for

Sales and lead generation. Filter a prospect list down to the sites running the platform your product integrates with, so outreach goes where the integration story is already true.

Agencies. Check a prospect's stack before a pitch and open with what they actually run rather than a generic capability deck.

Developers and AI agents. Call detect_stack as a CRM enrichment step: submit a domain, attach the detected stack to the record, route the lead on what came back.

Security and research teams. Passively identify exposed software and versions from public headers and markup as a first-pass reconnaissance step.

When to use it, and when not to

Use it to identify a site's public technology signals — CMS, framework, ecommerce platform, analytics, CDN and hosting — for one site or up to 50 at a time.

Do not use it as a security audit or as an inventory of everything a site runs. It reads one public page and reports what left an observable trace. Absence of a technology means no signature matched, not that it is definitely not in use. Technologies that only reveal themselves after client-side JavaScript runs will not be detected.

Why it's built this way

• Real fingerprint matching, not a guess — an open-source community dataset of over 7,500 technologies, refreshed monthly.
• No headless browser — a single lightweight capped, streamed fetch rather than a multi-second browser launch. Fast and cheap enough to bulk-check dozens of sites.
• Honest about failure — a blocked or anti-bot-protected site is reported as BLOCKED, never silently reported as "no technology detected." That distinction is the main way naive detectors mislead people.
• Confidence-scored, with evidence — every technology carries a 0–100 score and a short note on what matched (a header, a cookie, a script src, markup), not a black-box yes/no.
• Bulk-ready — scan up to 50 URLs in one call, 5 at a time, with a pass/fail summary. A single bad URL never fails the batch.
• Nothing stored — pages are fetched, matched, and forgotten. No crawling beyond the page you asked for.

Tools

detect_stack — fetch one public page and detect its technology stack. Returns category, confidence and evidence per technology, and distinguishes "blocked" from "nothing detected."

{ "url": "wordpress.org" }

{
  "input": "wordpress.org",
  "finalUrl": "https://wordpress.org/",
  "httpStatus": 200,
  "status": "OK",
  "technologies": [
    { "name": "WordPress", "category": "CMS", "confidence": 100, "evidence": "meta: generator, html markup" },
    { "name": "PHP", "category": "Programming languages", "confidence": 100, "evidence": "implied by WordPress" }
  ],
  "categoriesSummary": { "CMS": 1, "Programming languages": 1 }
}

bulk_detect_stack — detect the stack for up to 50 URLs in one call, processed 5 at a time, with a pass/fail summary.

{ "urls": ["wordpress.org", "shopify.com"] }

Returns { results: [...], summary: { total, ok, no_tech, unreachable, blocked, invalid_input } }.

Use cases

• Agency prospecting — check what a prospect's site is built on before a pitch or proposal.
• Sales qualification — filter a lead list by CMS or ecommerce platform.
• Competitive research — see which analytics, tag managers and marketing tools competitors run.
• Security recon — passively identify exposed software and versions as a first pass.
• Bulk list enrichment — run a CSV of domains through bulk_detect_stack to tag each by platform.

Trust & limits

Fetches only the single public page at the URL you give it (and whatever redirect that page itself issues) — no login or paywall bypass, no anti-bot evasion, no crawling beyond that one page. The tool identifies itself honestly via its User-Agent. Nothing is stored: pages are fetched, matched, and forgotten. This is a lookup aid, not a guarantee — some technologies are genuinely undetectable without running JavaScript, and a low-confidence match is a hint, not a certainty.