Techstack Intel

Company Research

Detect a company's technology stack from their website — no API keys needed.

techstackdnsheadersno-api-key

Overview

Techstack Intel analyzes a company's website to detect what tools and technologies they use. It runs seven parallel detectors that inspect HTTP headers, HTML source, DNS records, SSL certificates, cookies, robots.txt, and favicon hashes. The result is a categorized list of technologies with confidence scores and evidence — useful for qualifying leads based on their stack. Unlike services like BuiltWith or Wappalyzer that charge per lookup, Techstack Intel runs entirely locally with zero API costs.

Currently macOS only. Windows and Linux support coming soon.

Use Cases

Qualify Leads Based on CRM and Marketing Stack

You sell a Salesforce integration. Before reaching out to a lead, you run Techstack Intel on their domain to see if they actually use Salesforce. The tool detects Salesforce via DNS records (MX and TXT entries), cookie patterns, and JavaScript references in their page source. It also picks up HubSpot marketing tags, Google Analytics, and Intercom chat — giving you a complete picture of their go-to-market stack.

Expected outcome: A categorized technology report showing the prospect uses Salesforce (high confidence), HubSpot Marketing Hub, Google Analytics 4, and Intercom. Your rep can now personalize outreach around their existing Salesforce setup.

Competitive Intelligence on Technology Adoption

Your product competes with Zendesk. You want to find companies currently using Zendesk to target for displacement. You run Techstack Intel across a list of prospect domains and filter the results for Zendesk detections. The tool identifies Zendesk through JavaScript widget embeds, cookie names, and CDN references.

Expected outcome: A filtered list of companies confirmed to use Zendesk, with confidence scores. Reps can prioritize high-confidence detections and tailor their outreach around migration from Zendesk.

Map a Prospect's Infrastructure Before a Technical Sale

You are preparing for a technical demo with a mid-market prospect. You run Techstack Intel on their website to understand their infrastructure choices — hosting provider, CDN, SSL provider, email infrastructure, and development frameworks. This helps your solutions engineer tailor the demo to their actual environment.

Expected outcome: A full infrastructure breakdown showing AWS hosting (detected via headers), Cloudflare CDN, Let's Encrypt SSL, and a React frontend — allowing the SE to demo with relevant integration examples.

Capabilities

●Runs seven detection methods in parallel for fast, comprehensive results
●Inspects HTTP response headers for server, CDN, and framework fingerprints
●Analyzes HTML source and DOM for JavaScript frameworks, analytics tags, and embedded widgets
●Queries DNS records (MX, TXT, NS, CNAME) to detect email and infrastructure tools
●Examines SSL certificate details for hosting and security provider identification
●Matches favicon MD5 hashes against a known technology database
●Returns confidence scores (0–100) with supporting evidence for every detection
●Requires zero API keys — all detection runs locally using public signals

Data Sources

Source	What’s Extracted
HTTP Headers	Web server, CDN, framework, and hosting signals
HTML/DOM	CMS, JS frameworks, analytics, chat widgets, marketing tools
DNS Records	MX, TXT, NS, and CNAME records for email and infrastructure tools
SSL Certificates	Certificate issuer, subject, and SAN inspection
Cookies	Technology fingerprints from cookie names and values
Robots.txt	Technology signals from crawl directives
Favicon	MD5 hash matching for platform identification

Tools

Detects what tools and technologies a company uses by analyzing their website source code, HTTP headers, DNS records, SSL certificates, cookies, robots.txt, and favicons. Returns categorized results with confidence scores.

Parameters

Name	Type	Required	Description
`url`	string	Yes	Website URL to analyze (https:// prepended automatically if missing)

Response Fields

url
final_url
domain
scan_timestamp
scan_duration_seconds
technologies (name, category, subcategory, confidence, evidence, version, website)
raw_signals (headers, DNS records, SSL issuer, favicon hash)

Dependencies

●macOS (Windows and Linux support coming soon)
●Python 3.11+
●httpx, dnspython, tldextract (installed automatically)
●No API keys required

Works With

Use Techstack Intel after Website Intel to understand a prospect's tools. If they're using a competitor or complementary product, that's a signal. Chain with Hiring Intel to see if they're hiring for roles related to the tools you detected.

Quick Setup

git clone https://github.com/ekas-io/open-sales-stack.git
cd open-sales-stack
./scripts/setup.sh

./scripts/add-to-claude.sh --techstack-intel

See full setup instructions on GitHub →

Frequently Asked Questions

How does Techstack Intel detect technologies without an API key?▾

Techstack Intel uses only publicly available signals. It sends HTTP requests to read headers and HTML, performs DNS lookups, checks SSL certificates, reads robots.txt and cookies, and computes favicon hashes. All of these are public signals that any browser would see. No third-party API or paid data source is involved.

How accurate are the technology detections?▾

Each detection includes a confidence score from 0 to 100 based on the strength of the evidence. A technology detected through multiple signals (e.g., both DNS records and JavaScript tags) will score higher than one detected through a single signal. In general, common tools like Google Analytics, Salesforce, HubSpot, and major frameworks are detected with high confidence.

Can Techstack Intel detect backend technologies like databases?▾

Techstack Intel can only detect technologies that leave traces in publicly accessible signals. Backend databases, internal tools, and server-side languages that don't expose themselves in headers, DNS, or page source will not be detected. It excels at detecting frontend frameworks, analytics, marketing tools, CDNs, email providers, and hosting platforms.

How long does a scan take?▾

A typical scan completes in 3 to 8 seconds. The seven detectors run in parallel, so the total time is roughly the slowest detector (usually DNS lookups). Domains with many subdomains or complex DNS configurations may take slightly longer.

Can I scan multiple domains in bulk?▾

The MCP processes one domain at a time. To scan multiple domains, you can call the tool repeatedly in sequence or have Claude loop through a list. Since each scan is independent and fast, batch processing is straightforward.