Website Tech Stack Lookup: 7,600+ technologies + company data for AI agents

What it does: give it a list of domains; get back one JSON row per site with its full technology stack (CMS, ecommerce platform, JavaScript frameworks, analytics, tag managers, ad pixels, marketing automation, CRM, live chat, payments, CDN, hosting, web server) with versions, a confidence score and the evidence for every detection, plus company data from the same visit: email provider, DNS provider, email-sending services, SaaS tools proven by DNS verification records, socials, emails, phones, contact/careers/pricing pages, logo, favicon, sitemaps and JSON-LD organization info.

Use it when an agent or sales workflow needs to: qualify leads by technology ("is this a Shopify store?", "do they use HubSpot?"), research a competitor's stack, enrich a CRM list with tech + contact data, find every site in a list running a given tool, or audit a site's email security (SPF/DMARC).

Don't use it for: historical tech data or "all sites using X" discovery (this checks live sites you name), pages behind a login, or reading page content (use catalyst-labs/agent-web-reader).

Why agents choose this

Found 93% of known technologies on 31 well-known sites, vs 65% and 59% for the two most-used tech-stack Actors on the Apify Store, and reports about 22 technologies per site vs about 4.

Test (Oct 25, 2026)	This Actor (cloud)	automation-lab/tech-stack-detector	scrapemint/website-tech-stack-detector
Known technologies found (46 across 31 sites)	43/46 (93%)	30/46 (65%)	27/46 (59%)
Technologies reported per site (avg)	22.1	3.8	3.1

• Returns: one row per domain with techNames, a summary per category (cms, ecommerce, payments, hosting...), full technologies with version, confidence and evidence, plus email/DNS providers, socials and contact pages.
• Cost: $0.003 per site. Sites that fail are never charged.
• Speed: most sites answer in 1 to 8 s over plain HTTP; a browser pass is used only when needed. Up to 1,000 domains per run.
• Known misses in this test: React on airbnb.com, Drupal on drupal.org, Django on djangoproject.com.

Test conditions: our own run against a hand-checked list of technologies for 31 sites (WordPress, Shopify, Next.js, Laravel and others), each tool at default settings. Not an independent audit.

Why it's different

• 7,600+ technology fingerprints from the actively maintained open Wappalyzer dataset (enthec/webappanalyzer), plus our own fixes for modern frameworks (Next.js App Router, Angular 17+, SvelteKit, Astro, Nuxt, VitePress). Most tech-stack Actors check 45-200 hard-coded signatures.
• Every signal Wappalyzer uses: HTTP headers, cookies, meta tags, HTML, inline scripts, script URLs, DOM selectors, robots.txt, TLS issuer, DNS (MX/TXT/NS/SOA/CNAME) and, in a real browser, JavaScript globals and XHR calls.
• Fast first, browser only when needed: an HTTP check answers most sites in 1-8 s. Only JavaScript-rendered, blocked or thin pages get a real Chrome pass. Same price either way.
• DNS intelligence competitors skip: email provider, DNS host, email-sending services from SPF (SendGrid, Mailchimp, HubSpot...), DMARC policy, and SaaS proven by domain-verification TXT records (Atlassian, Stripe, DocuSign, OpenAI, Zoom...).
• Agent-ready output: techNames (flat list), summary (one answer per group: cms, ecommerce, payments, hosting...), and full technologies with evidence. Every row has the same fields; failures get an errorCode and are never charged.
• Bulk: up to 1,000 domains per run, 10-25 in parallel. Also callable as an HTTP endpoint (Standby) for one-off agent lookups.

Cost

Event	Price	When
site	$0.003	per website analyzed successfully (tech stack + metadata + DNS)

No start fee. Unreachable, blocked, DNS-failed or invalid domains are never charged. 1,000 sites = $3. Set maxTotalChargeUsd on the run to cap spend; when the cap is hit the remaining sites return SPENDING_LIMIT rows and are not charged.

Input (only domains is required)

{ "domains": ["stripe.com", "allbirds.com", "https://www.wordpress.org"] }

{ "domains": ["gymshark.com"], "mode": "full", "includeEvidence": false }

Field	Default	Notes
domains	–	Domains or URLs, up to 1,000. Duplicates removed.
mode	auto	auto = HTTP + browser only when needed; fast = HTTP only; full = always add the browser pass.
includeMetadata	true	Title, description, socials, emails, phones, key pages, logo, favicon, sitemaps, feeds, JSON-LD org.
includeDns	true	Email/DNS providers, SPF services, DMARC, SaaS verified in TXT records.
crawlContactPage	true	Read the contact page too when the homepage shows < 3 emails. No extra charge.
minConfidence	50	Drop weaker detections (0-100).
includeEvidence	true	Why each technology was detected. Turn off for smaller rows.
maxConcurrency	10	Sites in parallel (1-25).
timeoutSecs	20	Per-site timeout; slow sites become error rows (not charged).

Output (one row per site)

{
  "status": "ok",
  "domain": "allbirds.com",
  "finalUrl": "https://www.allbirds.com/",
  "detectionMode": "http",
  "technologyCount": 16,
  "techNames": ["Shopify", "Cloudflare", "Google Tag Manager", "PayPal", "Apple Pay", "Microsoft 365", "..."],
  "summary": { "cms": [], "ecommerce": ["Shopify"], "payments": ["Apple Pay", "PayPal"], "cdn": ["Cloudflare"], "tagManagers": ["Google Tag Manager"], "hosting": [], "...": [] },
  "technologies": [
    { "name": "Shopify", "version": null, "confidence": 100, "categories": ["Ecommerce"], "website": "https://shopify.com", "saas": true, "pricing": ["low", "recurring"], "evidence": ["header:x-shopid", "script \"https://cdn.shopify.com/...\""], "implied": false, "layer": "website" }
  ],
  "site": { "title": "Allbirds: Comfortable, Sustainable Shoes & Apparel", "emails": ["help@allbirds.com"], "socials": { "instagram": "https://instagram.com/allbirds", "tiktok": "https://tiktok.com/@weareallbirds" }, "contactPage": "https://www.allbirds.com/pages/help", "sitemaps": ["https://www.allbirds.com/sitemap.xml"], "favicon": "...", "organization": null },
  "dns": { "emailProvider": "Microsoft 365", "dnsProvider": null, "emailSendingServices": ["Microsoft 365"], "dmarcPolicy": "quarantine", "verifiedServices": ["DocuSign", "Miro", "Google Search Console"] },
  "tls": { "issuer": "Let's Encrypt", "validTo": "2026-12-01T00:00:00.000Z", "protocol": "TLSv1.3" },
  "ms": 4188, "errorCode": null
}

layer tells you whether a technology was seen on the website itself (website) or only in DNS records (dns, e.g. a SaaS verification). Error codes: INVALID_URL, DNS_NOT_FOUND, TIMEOUT, BLOCKED (bot challenge even in a real browser), HTTP_4xx/5xx, SPENDING_LIMIT, INTERNAL_ERROR. One bad domain never fails the run. The OUTPUT key-value record holds all rows plus okCount, errorCount and chargedEvents.

Use from an AI agent (MCP)

Add catalyst-labs/website-tech-stack-lookup to the Apify MCP server (https://mcp.apify.com/?tools=catalyst-labs/website-tech-stack-lookup), then ask: "What CMS, payments and email provider does gymshark.com use?" The agent reads summary and dns and answers in one call.

HTTP (Standby): GET https://catalyst-labs--website-tech-stack-lookup.apify.actor/?domains=stripe.com,shopify.com with your Apify token as a Bearer header.

Accuracy notes

Detection is only as good as what a site exposes. Server-side frameworks that leave no trace on the homepage (for example Django on djangoproject.com) can't be seen by any external tool, and sites behind strict bot walls return BLOCKED (not charged). Fingerprint data: enthec/webappanalyzer, GPL-3.0.