Tech Stack & Email Finder - BuiltWith Alternative

Find out what any website runs — CMS, e-commerce platform, analytics, CRM, marketing pixels, email provider, hosting — plus the emails listed on it. One flat, enrichment-ready row per domain, built for Clay, Attio, and outbound workflows.

Feed it a list of URLs or bare domains. For each one you get a single record with filterable tech columns (cms, ecommerce, crm, email_provider, …), the full detection detail underneath, DNS-derived infrastructure intel, and an emails[] array with domain-match flags. A BuiltWith alternative and Wappalyzer alternative priced for list enrichment, not enterprise dashboards.

What you can do with it

Tech stack is one of the highest-value qualification and segmentation signals in outbound. With one enrichment pass you can:

• Segment by platform combo — "all Shopify + Klaviyo shops" → run platform-specific campaign angles
• Pitch on absence — "WordPress agencies with no chat widget / no analytics" → the missing tool becomes the opener
• Score GTM maturity — CRM + marketing automation + A/B testing presence tells you how sophisticated an account's stack is
• See backend infrastructure no pixel reveals — email_provider from MX records (Google Workspace vs Microsoft 365 vs self-hosted)
• Catch hiring signals — recruitment_staffing (Greenhouse, Lever, …) from career-page infrastructure
• Clean your list while enriching it — is_parked drops dead domains before you spend sending budget on them
• Get a contact channel in the same pass — extracted emails with domain_match flags, no second enrichment tool

Why this instead of the alternatives

	Price	Output shape	Detection depth	Emails
BuiltWith / Wappalyzer SaaS	$295–450/mo	Dashboards & exports	Deep, but priced for enterprise	❌
Other tech-stack actors (full-breadth)	$10–100/1k	Tech lists	6,000–7,500 fingerprints, no email extraction	❌
HTTP-only detector actors	cheap	varies	45–106 hardcoded techs; miss everything injected after hydration — GTM pixels, SPA markup, network beacons	❌
Standalone email finders	~$10/1k	Emails only	No tech detection at all	✅
This actor	from $6/1k + usage — no result fee on failed scans	Flat, Clay-ready + full detail	~7,500 fingerprints, real browser, network interception, DNS	✅

Output

One row per input URL. Every field is always present — scalars null, lists empty, never omitted — so your downstream schema never breaks.

Key columns (operator's glossary)

Column	What it tells you
cms	Content platform (WordPress, Webflow, …)
ecommerce	Shop platform (Shopify, WooCommerce, …)
crm	CRM detected on the site (HubSpot, …)
marketing_automation	Marketing automation platform
email	Email marketing/delivery tools (Klaviyo, Mailchimp, …)
email_provider	Backend mail host from MX records (Google Workspace, Microsoft 365, …)
analytics[]	Analytics tools
advertising[]	Ad & pixel tags (Meta Pixel, LinkedIn Insight, …)
retargeting[]	Retargeting tags
tag_managers	Tag manager (GTM, …)
live_chat	Chat widget — absence is a pitch trigger
customer_data_platform	CDP (Segment, …)
payment_processors[]	Payment rails (Stripe, PayPal, …)
buy_now_pay_later / cart_abandonment / shipping_carriers[]	E-commerce ops maturity
ab_testing / personalisation / surveys	Experimentation & CRO maturity
cookie_compliance	Privacy tooling — strong EU signal
appointment_scheduling	Calendly etc. — sales-touch motion
form_builders	Lead-capture stack
reviews	Social-proof investment
recruitment_staffing	Hiring infrastructure (Greenhouse, Lever, …)
artificial_intelligence[]	AI adoption signal
page_builders	Elementor/Divi — agency-prospecting signal
cdn / hosting	Infrastructure
javascript_frameworks[] / web_frameworks[]	Build stack
has_dmarc	Email security posture (from TXT)
is_parked	Parked/dead domain — drop it from your list
tech_count	Total technologies detected
tech_by_category	Every native category → detected techs, for anything not covered above
technologies[]	Full audit detail: name, categories, version, confidence, evidence
emails[]	{ email, domain_match, source_path }
error / detection_error_reason	Honest failure status — see below

Sample row (abridged)

{
  "url": "gymshark.com",
  "domain": "gymshark.com",
  "cms": null,
  "ecommerce": "Shopify",
  "email": "Klaviyo",
  "email_provider": "Google Workspace",
  "analytics": ["Google Analytics"],
  "advertising": ["Meta Pixel", "TikTok Pixel"],
  "tag_managers": "Google Tag Manager",
  "live_chat": null,
  "has_dmarc": true,
  "is_parked": false,
  "tech_count": 24,
  "tech_by_category": { "Ecommerce": ["Shopify"], "Analytics": ["Google Analytics"] /* … */ },
  "technologies": [
    { "name": "Shopify", "categories": ["Ecommerce"], "version": null, "confidence": 100, "evidence": "network:cdn.shopify.com" }
    /* … */
  ],
  "dns": { "mx": ["aspmx.l.google.com"], "ns": ["…"], "txt_verifications": ["google-site-verification"], "cname": null, "dmarc": "v=DMARC1; p=quarantine" },
  "emails": [{ "email": "support@gymshark.com", "domain_match": true, "source_path": "/contact" }],
  "error": false,
  "detection_error_reason": null,
  "cached": false,
  "scanned_at": "2026-07-11T12:00:00.000Z"
}

Use it in Clay

1. In your Clay table, add an HTTP API enrichment column.

2. Method: POST — URL:

   https://api.apify.com/v2/acts/inatanli~tech-stack-detector/run-sync-get-dataset-items?token={{your Apify API token}}
   

3. Body:

   { "startUrls": ["{{Domain}}"] }
   

4. Reference results with dot-notation: ecommerce, email_provider, emails[0].email, or any category via tech_by_category.Ecommerce.

5. Gate downstream tables on the flat fields — e.g. only continue where ecommerce = "Shopify" and email = null (no email marketing tool = your pitch).

Re-runs of the same domains within 7 days are served from cache — fast and cheap. Pass "skipCache": true to force fresh scans.

Use it from an AI agent (MCP)

The actor is callable through Apify's MCP server, so an agent can answer "what does acme.com run?" inside a loop:

{
    "mcpServers": {
        "apify": {
            "command": "npx",
            "args": [
                "mcp-remote",
                "https://mcp.apify.com/?tools=inatanli/tech-stack-detector",
                "--header",
                "Authorization: Bearer <YOUR_API_TOKEN>"
            ]
        }
    }
}

Input

Field	Type	Default	Description
startUrls	array	—	URLs or bare domains; one output row each
proxyConfiguration	object	Apify auto	Standard proxy config
skipCache	boolean	false	Bypass the 7-day result cache
extractEmails	boolean	true	Disable the contact-page probe for faster, cheaper runs

Reading the results

Rows with error: true mean the scan failed (detection_error_reason says why) — filter them out before treating empty fields as "doesn't use it." Failed scans incur no result fee. And a missing detection isn't proof a tool isn't used: backend-only tools with no public web signal may stay invisible.

---

Technology fingerprints from enthec/webappanalyzer (GPL-3.0), refreshed at every image build.