Cookie, Tracker & Technology Inventory

Inventory observed script indicators, cookie attributes and optional browser hosts.

Example.com inputs are placeholders, not verified compatible content. Replace them with your permitted source. Run npm run smoke for an account-free deterministic example. JSON Feed, RSS and table examples use the separately recorded small live-test sources; they do not imply compatibility with every site.

What it does

Produces page-audit records for website analysts. Values are extracted deterministically from public pages; unavailable fields remain null.

Common use cases

Inventory observed script indicators, cookie attributes and optional browser hosts. Use the resulting dataset in scheduled tasks, API pipelines, spreadsheets, or agent workflows.

Input

Field	Type	Description
urls	array	Public HTTP(S) URLs. No credentials or local-network targets.
maxPages	integer	Maximum pages scheduled in this bounded run.
renderJavaScript	boolean	Opt into Chromium for JavaScript content. More expensive; no access-control bypass.
respectRobotsTxt	boolean	Honor robots rules and supported crawl delays. Unavailable rules fail closed.
collectCookies	boolean	Collect Cookies. See README for extraction behavior.
collectScriptHosts	boolean	Collect Script Hosts. See README for extraction behavior.
collectNetworkHosts	boolean	Observe rendered GET/HEAD hosts; requires renderJavaScript. Blocked media, fonts and WebSockets are not fetched.
concurrency	integer	Maximum concurrent page handlers. Per-origin delays still apply.
requestDelayMs	integer	Minimum spacing between request starts to the same origin.
timeoutSecs	integer	Maximum individual request duration in seconds.
retries	integer	Retries for page handlers. Access blocks are not retried.
proxyConfiguration	object	Optional Apify or public custom proxy. Direct connections are the default.

Output

Field	Type
pageUrl	string or null
technologies	array or null
scriptHosts	array or null
observedCookies	array or null
cookieAttributes	array or null
thirdPartyHosts	array or null
thirdPartyHostDefinition	string or null
networkObservationMode	string or null
evidence	object or null
checkedAt	string or null

Results are in the default Dataset. RUN_SUMMARY, FAILURES and DIAGNOSTICS are available in the default key-value store. Diagnostics are not billed entity events. JSON, CSV and spreadsheet exports use Apify Dataset.

Example

Replace example.com with a public source relevant to this Actor. Plain example.com has no products, jobs or opportunities; an empty feed there is expected. Run the included local smoke test for a deterministic working example.

{
  "urls": [
    "https://example.com/"
  ],
  "maxPages": 1,
  "renderJavaScript": false
}

Example output

The following records come from synthetic local fixtures, not a live website or claimed customer data.

[
  {
    "pageUrl": "https://fixture.example/index",
    "technologies": [
      {
        "name": "Next.js",
        "category": "frontend-framework",
        "evidence": [
          "https://fixture.example/_next/static/main.js"
        ],
        "confidence": "observed-indicator"
      },
      {
        "name": "Fixture CMS",
        "category": "generator-meta",
        "evidence": [
          "meta[name=generator]"
        ],
        "confidence": "self-reported"
      }
    ],
    "scriptHosts": [
      "127.0.0.1"
    ],
    "observedCookies": [
      "fixture"
    ],
    "cookieAttributes": [
      {
        "name": "fixture",
        "domain": null,
        "path": "/",
        "secure": false,
        "httpOnly": false,
        "sameSite": "Lax",
        "expires": null,
        "maxAge": null,
        "source": "http-response"
      }
    ],
    "thirdPartyHosts": [],
    "thirdPartyHostDefinition": "Different hostname, not an ownership or legal classification",
    "networkObservationMode": "static",
    "evidence": {
      "generator": "Fixture CMS",
      "scriptUrls": [
        "https://fixture.example/_next/static/main.js"
      ],
      "networkHosts": []
    },
    "checkedAt": "2026-09-29T23:33:45.696Z"
  }
]

Pricing model

One page-audit event per visible result record. Event prices are configured in Apify Console, never in extraction code. The SDK enforces the run's maxTotalChargeUsd. Failed pages and diagnostic-only messages are not billed. Do not configure an additional automatic default-dataset-item event.

How it works

Crawlee BasicCrawler manages bounded requests and retries. Cheerio parses HTTP HTML. A DNS-pinned transport validates every redirect and checks robots rules. Chromium is opt-in and its page requests pass through the same transport. No external paid API is required.

Limits

• Technology detection is indicator-based and not exhaustive.
• Cookie values are never returned; a different hostname is not proof of different ownership.
• This is a technical inventory, not a legal verdict.
• Public GET/HEAD content only; no login, form submission, CAPTCHA solving or browser stealth.
• Responses are capped at 2 MiB decoded. Browser mode caps requests per page and blocks media, fonts, downloads, service workers and WebSockets.
• Missing/blocked robots rules fail closed. Robots crawl delays above 60 seconds are not supported.
• Start at 512 MB for static runs; use 2 GB for browser runs and measure representative targets.

Responsible use

Use only public content you are authorized to access. Respect source terms, licenses and applicable law. No private-account extraction, personal-data enrichment, credential input or access-control bypass is provided. Cookie values are never returned.

Local development

Requires Node.js 24 LTS. All commands below run from this Actor directory.

npm ci --ignore-scripts
npm run input:example
# Edit storage/key_value_stores/default/INPUT.json with your public URLs.
npm run start:dev
npm test
npm run typecheck
npm run lint
npm run validate
npm run build
npm start
npm run smoke
npx apify run
docker build -t cookie-tracker-tech-inventory .

Browser testing: set PLAYWRIGHT_BROWSERS_PATH to an Actor-local .cache/browsers directory, then run npx playwright install chromium. Docker installs its own matching browser.

Deployment

Deploy only after validating the Docker build and a representative target. Deployment is not performed by installation or tests.

npx apify login
npx apify push

Then configure the exact event in Console, set pricing and spending limits, test a private run, complete PUBLICATION_CHECKLIST.md, and deliberately enable Store visibility.

API usage

Replace YOUR_USERNAME with your Apify account name. Keep the token in an environment variable rather than input JSON.

$curl -X POST "https://api.apify.com/v2/acts/YOUR_USERNAME~cookie-tracker-tech-inventory/runs?maxTotalChargeUsd=1" -H "Authorization: Bearer $APIFY_TOKEN" -H "Content-Type: application/json" --data-binary @examples/basic-input.json

Monitor the returned run ID and read its default Dataset. Store/API names and price configuration are account-side settings.

Verified platform example

The saved Console input performs a bounded HTTP run with one page and at most two result records. The source is a public example/test page. The result demonstrates the audit or extraction interface.

Use the saved default input in Apify Console, or the repository examples/basic-input.json. Replace its source with your own permitted URL and keep limits small for the first run.

The following unmodified record was returned by a successful Apify platform run on 2026-09-30:

[
  {
    "pageUrl": "https://example.com/",
    "technologies": [],
    "scriptHosts": [
      "example.com"
    ],
    "observedCookies": [],
    "cookieAttributes": [],
    "thirdPartyHosts": [],
    "thirdPartyHostDefinition": "Different hostname, not an ownership or legal classification",
    "networkObservationMode": "static",
    "evidence": {
      "generator": null,
      "scriptUrls": [
        "https://example.com/s.js"
      ],
      "networkHosts": []
    },
    "checkedAt": "2026-09-30T13:50:29.459Z"
  }
]

Introductory pricing: $1.00 per 1,000 page-audit results, plus Apify platform usage. The standard Actor start event costs $0.00005 per GB (minimum one event). Empty output and duplicate records incur no primary result event; the start fee and any platform usage still apply. The SDK enforces the event spending limit; platform usage is billed separately.