# Domain Well-Known Protocol & App Link Signals Enricher (`deepaksheoran172/domain-protocol-signals-enricher`) Actor

Extracts evidence-backed B2B signals from public domain endpoints: Android assetlinks.json, iOS AASA, OIDC/OAuth metadata, RFC 9116 security.txt, RFC 8461 mta-sts.txt, Apple merchant domain association, and llms.txt.

- **URL**: https://apify.com/deepaksheoran172/domain-protocol-signals-enricher.md
- **Developed by:** [Deepak Sheoran](https://apify.com/deepaksheoran172) (community)
- **Categories:** Developer tools, Lead generation
- **Stats:** 2 total users, 1 monthly users, 90.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

$3.00 / 1,000 domain protocol & app link signals probeds

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

<p align="center">
  <img src="https://raw.githubusercontent.com/deepakshe/apify-b2b-super-actors/main/assets/actor_icons/domain-protocol-signals-enricher.png" width="96" height="96" alt="Bulk Domain Protocol & Tech Stack Enricher Icon" style="border-radius: 20px; box-shadow: 0 8px 24px rgba(0,0,0,0.18);" />
</p>

<p align="center">
  <a href="https://apify.com/deepaksheoran172/domain-protocol-signals-enricher"><img src="https://img.shields.io/badge/Apify_Store-Active_PPE-blue?style=for-the-badge&logo=apify" alt="Apify Store" /></a>
  <a href="https://apify.com/deepaksheoran172/domain-protocol-signals-enricher"><img src="https://img.shields.io/badge/Launch_Discount-60%25_OFF-success?style=for-the-badge" alt="60% Launch Discount" /></a>
  <img src="https://img.shields.io/badge/Architecture-Zero--Proxy_Fast-informational?style=for-the-badge" alt="Zero-Proxy Fast" />
  <img src="https://img.shields.io/badge/QA_Validation-Verified_Pass-brightgreen?style=for-the-badge" alt="Verified QA Pass" />
</p>

## Domain Well-Known Protocol & App Link Signals Enricher

> **Extract evidence-backed B2B signals from public domain endpoints: Android `assetlinks.json`, iOS AASA, OpenID Connect/OAuth discovery, RFC 9116 `security.txt`, RFC 8461 `mta-sts.txt`, Apple merchant domain verification files, and `/llms.txt`.**

[![Apify Actor](https://img.shields.io/badge/Apify-Actor-blue?logo=apify)](https://apify.com/deepaksheoran172/domain-protocol-signals-enricher)
[![Pay-Per-Event](https://img.shields.io/badge/Pricing-Pay--Per--Event%20\($0.001%2Fdomain\)-green)](https://apify.com/deepaksheoran172/domain-protocol-signals-enricher)
[![Status](https://img.shields.io/badge/Status-Production%20Hardened-success)](#)
[![MCP Ready](https://img.shields.io/badge/MCP%20Server-Ready-purple)](https://mcp.apify.com/?tools=deepaksheoran172/domain-protocol-signals-enricher)

***

### ⚡ The Acute B2B Pain vs. Instant Relief

#### The Problem in Modern Outbound & Account Qualification

When qualifying enterprise accounts in **Clay**, **n8n**, or internal GTM pipelines, answering technical questions usually requires fragile, expensive HTML scraping:

- *Does this target account build native mobile apps?* (Scraping App Store / Google Play breaks on anti-bot gates).
- *Do they maintain an active vulnerability reporting program?* (Manual inspection takes 15 minutes per domain).
- *Do they enforce strict SMTP email encryption?* (MTA-STS policies are buried in DNS and web endpoints).
- *Do they curate modern AI/LLM markdown documentation?* (`/llms.txt`).

#### The Direct Manifest Approach

Standard web scrapers crawl arbitrary HTML pages to guess tech stacks. In contrast, modern platforms publish machine-readable RFC manifests directly under `/.well-known/`. This Actor queries standardized protocol files directly at **$0.001 per domain**, returning tri-state verified evidence into your Clay tables or CRM.

***

### 💰 Pay-Per-Event (PPE) Pricing & Fair-Billing Model

| Capability / Metric | Custom HTML Web Scraping | Standardized RFC Protocol Probing |
|---|---|---|
| **Pricing Model** | Variable compute / proxy costs | **Fixed $0.001 per probed domain** |
| **Mobile App Link Discovery** | Parses unpredictable HTML markup | **Direct RFC `assetlinks.json` & AASA parsing** |
| **Vulnerability Policy (RFC 9116)** | Requires custom regex scrapers | **Direct `security.txt` & contact extraction** |
| **Email Security (RFC 8461)** | Multi-step DNS + web scripts | **Deterministic MTA-STS mode (`enforce`/`testing`)** |
| **Fair-Billing Policy** | Billed on attempt regardless of failure | **Unresolvable (NXDOMAIN/SSRF) domains = $0.00** |

> \[!NOTE]\
> **Fair-Billing Policy:** Custom event charges (`domain-probed` at $0.001) are assessed only when a domain scan completes. If an input domain fails DNS resolution (NXDOMAIN), triggers anti-SSRF IP blocks, or contains invalid syntax, it outputs with `charged: false` and `events_charged: []`.

***

### 🛡️ Tri-State Evidence Architecture (Zero False Negatives)

Most scrapers treat a blocked HTTP 403 response or a timeout as "Signal Not Found" (`false`). This Actor enforces a strict **Tri-State Evidence Model**:

| Classification | Trigger Conditions | Business Interpretation |
|---|---|---|
| **`detected`** | HTTP 200 with valid, non-HTML payload parsed successfully. | Signal confirmed present on domain. |
| **`not_found`** | HTTP 404 or HTTP 410 returned by server. | Signal confirmed absent. |
| **`blocked_or_challenged`** | HTTP 401, 403, 429, 503, or WAF challenge headers (Cloudflare, AWS WAF). | Endpoint protected by access gates; capability cannot be ruled out. |
| **`invalid_format`** | HTTP 200 returning HTML (`<!DOCTYPE html>` or `<html`) when expecting JSON/RFC text. | Soft-200 SPA catch-all fallback or parking page; filtered out to eliminate false positives. |
| **`unreachable`** | DNS failure (NXDOMAIN), connection timeout, or TLS handshake error. | Target domain or host is offline or unresolvable. |

Every probe records `status`, `http_status`, `evidence_url`, `content_type`, `confidence`, and descriptive audit `notes`.

***

### ⚠️ Explicit Signal Boundaries & Non-Claims

To preserve 100% technical integrity and regulatory compliance:

- **Mobile App Link Manifests (`assetlinks.json` / AASA):** Proves which mobile applications are specifically configured for domain-associated deep linking. **It does NOT represent a company's complete mobile app inventory** (internal or non-linked apps will not appear).
- **Apple Merchant Association File:** Proves that the domain hosts Apple's merchant domain verification file for Apple Pay on the Web. **It does NOT prove that Apple Pay is actively offered at checkout**.
- **RFC 9116 `security.txt`:** Proves the existence of a vulnerability disclosure intake channel. **It does NOT certify ISO 27001 or SOC 2 compliance**.
- **WAF Limitations:** Domains with aggressive anti-bot protections may challenge automated probes; these are labeled honestly as `blocked_or_challenged`.

***

### 📊 Live Side-by-Side Verification (Real Production Data)

| Target Account | Domain | Android App Links | iOS Universal Links | RFC 9116 Security.txt | MTA-STS | Apple Merchant File |
| :--- | :--- | :--- | :--- | :--- | :--- | :--- |
| **Linear** | `linear.app` | **`detected`** (4 packages) | **`detected`** (`com.linear`) | **`detected`** (HackerOne URI) | `none` | `not_found` |
| **Vercel** | `vercel.com` | `not_found` | `not_found` | **`detected`** (security email) | `none` | `not_found` |
| **Supabase** | `supabase.com` | `not_found` | `not_found` | **`detected`** (disclosure URI) | `none` | `not_found` |
| **Gymshark** | `gymshark.com` | **`detected`** (1 package) | **`detected`** (1 App ID) | `not_found` | `none` | **`detected`** (Apple Pay) |
| **Inngest** | `inngest.com` | `not_found` | `not_found` | `not_found` | `none` | `not_found` |

***

### ⚡ 1-Click Clay Table Integration Recipe

Enrich B2B sales lists with mobile engineering signals, security posture, and MTA-STS email transport security:

1. **Clay Action:** HTTP API Request
2. **Method:** `POST`
3. **URL:** `https://api.apify.com/v2/acts/deepaksheoran172~domain-protocol-signals-enricher/run-sync-get-dataset-items`
4. **Headers:**
   - `Content-Type: application/json`
   - `Authorization: Bearer YOUR_APIFY_TOKEN` *(Configure securely via Clay Headers account)*
5. **Body:**
   ```json
   {
     "domains": ["{{company.domain}}"],
     "concurrency": 5,
     "request_timeout_secs": 10
   }
   ```
6. **Clay Formula Extractions (Verified Schema):**
   - **Has Android App:** `{{data[0].android_app_links_status == "detected"}}`
   - **Android Packages:** `{{data[0].android_package_names}}`
   - **Has iOS App:** `{{data[0].ios_aasa_status == "detected"}}`
   - **Vulnerability Disclosure:** `{{data[0].security_txt_status}}`
   - **Security Intake Contact:** `{{data[0].security_contacts[0]}}`
   - **MTA-STS Strict Mode:** `{{data[0].mta_sts_mode == "enforce"}}`
   - **Hosts Apple Pay File:** `{{data[0].apple_merchant_file_status == "detected"}}`

***

### 🚀 1-Click n8n Automated Cron Pipeline

Automate daily account enrichment using our pre-wired workflow:

1. Open n8n -> **Workflow > Import from URL**.
2. Paste: `https://raw.githubusercontent.com/deepakshe/apify-b2b-super-actors/main/workflows/tool7_domain_protocol_enricher_n8n.json`
3. Set your `APIFY_API_TOKEN` environment variable and run scheduled batches with zero code.

***

### 🤖 Claude Desktop & Cursor IDE (MCP Integration)

Connect directly to Apify's official remote MCP endpoint (`mcp.apify.com`) using Streamable HTTP:

```json
{
  "mcpServers": {
    "domain-protocol-enricher": {
      "url": "https://mcp.apify.com/?tools=deepaksheoran172/domain-protocol-signals-enricher",
      "headers": {
        "Authorization": "Bearer YOUR_APIFY_TOKEN"
      }
    }
  }
}
```

***

### 🔒 Security & Anti-SSRF Architecture

- **Pre-Flight DNS Resolution:** Target hostnames are resolved and checked against RFC 1918 private ranges, loopback (`127.0.0.0/8`, `::1`), and cloud metadata (`169.254.169.254`) before any network socket is opened.
- **Redirect Re-Validation:** Every HTTP redirect hop re-validates the destination IP via `SSRFSafeRedirectHandler`.
- **Streaming Buffer Cap:** HTTP response streams are strictly capped at 1 MB to prevent decompression bombs.

***

### 🚀 Ready to Enrich Your Domain Signals?

Audit your target account domains for RFC security and app-linking protocols in seconds:

1. Click **Try for free** at the top right of this page.
2. Enter a list of domains or import a CSV from Clay/HubSpot.
3. Export enriched technographic data to JSON, CSV, or direct webhooks.

[![Try Free on Apify](https://img.shields.io/badge/Run%20on%20Apify-Try%20Free%20\($5%20Credit\)-blue?style=for-the-badge\&logo=apify)](https://apify.com/deepaksheoran172/domain-protocol-signals-enricher)

***

### 📄 License

MIT © [Deepak Sheoran](https://apify.com/deepaksheoran172)

# Changelog

This Actor's version history is a separate document: https://apify.com/deepaksheoran172/domain-protocol-signals-enricher/changelog.md

# Actor input Schema

## `domains` (type: `array`):

List of domain names or hostnames to probe for well-known protocol and app association signals.

## `probe_app_links` (type: `boolean`):

Probe /.well-known/assetlinks.json (Android Digital Asset Links) and /.well-known/apple-app-site-association (iOS AASA Universal Links).

## `probe_identity_metadata` (type: `boolean`):

Probe /.well-known/openid-configuration and /.well-known/oauth-authorization-server metadata.

## `probe_security_policies` (type: `boolean`):

Probe RFC 9116 /.well-known/security.txt and RFC 8461 /.well-known/mta-sts.txt.

## `probe_domain_files` (type: `boolean`):

Probe /.well-known/apple-developer-merchantid-domain-association, /llms.txt, and /.well-known/atproto-did.

## `concurrency` (type: `integer`):

Maximum number of domains to probe concurrently.

## `request_timeout_secs` (type: `integer`):

Maximum timeout in seconds for each HTTP probe request.

## `max_domains` (type: `integer`):

Safety cap on the maximum number of domains processed per run.

## Actor input object example

```json
{
  "domains": [
    "stripe.com",
    "shopify.com",
    "example.com"
  ],
  "probe_app_links": true,
  "probe_identity_metadata": true,
  "probe_security_policies": true,
  "probe_domain_files": true,
  "concurrency": 5,
  "request_timeout_secs": 10,
  "max_domains": 500
}
```

# Actor output Schema

## `datasetItems` (type: `string`):

JSON array or CSV export of all enriched domain protocol and app association signals.

## `summaryJson` (type: `string`):

Execution summary containing total scanned domains, status tallies, and run metadata.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "domains": [
        "stripe.com",
        "shopify.com",
        "example.com"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("deepaksheoran172/domain-protocol-signals-enricher").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "domains": [
        "stripe.com",
        "shopify.com",
        "example.com",
    ] }

# Run the Actor and wait for it to finish
run = client.actor("deepaksheoran172/domain-protocol-signals-enricher").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "domains": [
    "stripe.com",
    "shopify.com",
    "example.com"
  ]
}' |
apify call deepaksheoran172/domain-protocol-signals-enricher --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,deepaksheoran172/domain-protocol-signals-enricher"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/CIKmCOHKazs1gmzO9/builds/InyRPcC6zk5L8AO3c/openapi.json