Company Tech Stack Detection: BuiltWith Alternative

🧱 What can Tech Stack Detector do?

Give it a company domain and it returns which go-to-market tools that company runs on its website, as flat boolean flags. CRM, sequencer, marketing automation and chat, plus a rolled-up signal strength. One row per domain, no JSON parsing required.

It renders the page with headless Chromium, so client-side tags that a plain HTTP fetch would miss are still caught.

📦 What you get	⚙️ Features and integrations
✅ Boolean flag per tool, uses_hubspot and friends 🧮 gtm_tool_count and a tech_stack_signal strength 🏷️ Category rollups for CRM, sequencer and automation 🧾 21 flat fields, snake_case, one row per domain	🖥️ Headless Chromium, catches client-side tags 📄 Crawls up to two extra public pages 🧊 Result cache, with a skipCache override ⬇️ Export to JSON, CSV, Excel, HTML or XML

Bought by Clay users building outbound qualification tables, agencies enriching lead lists at scale, and RevOps teams segmenting accounts by CRM and sequencer usage.

🚫 Backend-only tools cannot be detected and are out of scope by design. Clay, Salesloft, Instantly, Lemlist and server-side Segment leave no public client-side signal on a customer's website. The fingerprint file marks these detectable: false. Do not expect uses_clay: true even on companies you know use Clay. That is documented behavior, not a bug.

💡 Why use Tech Stack Detector?

If you want to find	Filter on
Companies on a competing CRM	uses_hubspot, uses_salesforce, crm_detected
Companies already running outbound	seq_tool_detected, uses_outreach, uses_apollo
Marketing automation buyers	marketing_automation_detected, uses_marketo
Conversational tooling	uses_drift, uses_intercom
A quick qualification gate	gtm_tool_count > 0, tech_stack_signal
Rows to review by hand	detection_error, detection_error_reason

🧮 How signal strength is derived

Strength	Criteria
high	CRM detected and sequencer detected and 3 or more total tools
medium	CRM or sequencer detected, 1 to 2 total tools
low	At least 1 tool detected, no CRM and no sequencer

The rule is published so you can rebuild it yourself from the raw flags, all of which are on the row.

▶️ Ready-to-run examples

Example	What it does
Detect a Company's CRM from its Website	CRM detection on one domain
Find Companies Using HubSpot or Marketo	Marketing automation targeting
Detect a Sales Sequencer	Outbound tooling detection
Bulk Tech Stack Scan	Run a whole list
Fresh Rescan, No Cache	Force a live re-check

📋 What data can Tech Stack Detector extract?

21 fields per domain.

Field	What it holds
crm_detected, seq_tool_detected, marketing_automation_detected	Category rollups
uses_hubspot, uses_salesforce	CRM flags
uses_outreach, uses_apollo, uses_gong, uses_clay	Sales tooling flags
uses_marketo	Marketing automation
uses_drift, uses_intercom	Conversational tooling
uses_zoominfo	Data tooling
gtm_tool_count	Total tools detected
tech_stack_signal	high, medium or low
detected_tools	The list, with what matched
detection_error, detection_error_reason	What went wrong, when something did
domain, company_domain, run_date	Identity and bookkeeping

⚠️ An all-false row does not always mean a clean negative. Sites fronted by enterprise bot protection can serve a valid 200 stub to headless Chromium, so nothing errors and every flag reads false with detection_error: false. Read the Known limits before you treat a row of falses as evidence a company runs nothing.

🛠️ How to detect a company's GTM tech stack

1. Open the Input tab and put a bare domain in domain.
2. Leave crawl_additional_pages on. It reads the pricing and product pages as well as the homepage, which is where several tags actually load.
3. For a list, use domains and set batchSize.
4. Click Start.
5. Filter on gtm_tool_count > 0 or on the specific uses_* flag you sell against.

🧪 Using it in Clay

Add an Apify enrichment column and map your domain column to domain. Every flag is a top-level boolean, so you can filter without writing a formula column or unwrapping any JSON.

Qualify a list instantly with gtm_tool_count > 0, then segment by the individual flags.

💵 How much does it cost to detect a tech stack?

You are charged once per domain analyzed.

Plan	Per domain	Per 1,000 domains
Free	$0.015	$15.00
Bronze	$0.0143	$14.30
Silver	$0.0135	$13.50
Gold	$0.0128	$12.80

There is also an Actor start event at $0.00005, charged once per run per GB of memory.

💳 A domain that detects nothing is still billed. The actor launched a browser, rendered the page and crawled up to two more, and an all-false row is a real result. This actor runs headless Chromium rather than plain HTTP, which is why it costs more per row than the HTTP-only actors in the suite and why it catches tags they would miss.

⌨️ Input

Everything is on the Input tab. The options worth explaining:

Field	Type	Default	What it does
domain	string	none	Bare company domain.
company_domain, url	string	none	Alternative input shapes for the same thing.
domains	array	none	Batch. One row per domain.
crawl_additional_pages	boolean	true	Also read the pricing and product pages.
batchSize	integer	5	Domains rendered concurrently.
skipCache	boolean	false	Force a fresh render.

📤 Output

One flat row per domain, exportable as JSON, CSV, Excel, HTML or XML.

{
  "domain": "example.com",
  "crm_detected": true,
  "seq_tool_detected": true,
  "uses_hubspot": true,
  "uses_salesforce": false,
  "uses_outreach": true,
  "uses_apollo": false,
  "uses_gong": false,
  "uses_zoominfo": false,
  "uses_drift": false,
  "uses_intercom": true,
  "uses_marketo": false,
  "uses_clay": false,
  "marketing_automation_detected": false,
  "gtm_tool_count": 3,
  "tech_stack_signal": "high",
  "detected_tools": ["HubSpot", "Outreach", "Intercom"],
  "detection_error": false,
  "detection_error_reason": null,
  "run_date": "2026-06-18T16:16:23.787Z"
}

💡 Tips

• Filter on the category rollups (crm_detected, seq_tool_detected) rather than individual flags when your pitch is category-level. It survives fingerprint changes better.
• Flag all-false rows on known enterprise domains for manual review rather than discarding them.
• Leave crawl_additional_pages on. Several tags load only on pricing or product pages.
• Do not build a "does not use X" segment from this actor alone. Absence is weaker evidence than presence, for the reasons in Known limits.

⚠️ Known limits

Bot-protected domains may return negative results. Sites fronted by Cloudflare Enterprise, Akamai Bot Manager or PerimeterX often serve a challenge page or stub to headless Chromium from a datacenter IP. The detector navigates successfully, captures an empty stub, and returns all-false with detection_error: false, because no error was thrown and the browser got a valid 200. Known examples include salesforce.com, zoominfo.com and marketo.com. Flag those rows for manual review.

Backend-only tools with no web pixel are out of scope. Clay, Salesloft, Instantly, Lemlist and server-side Segment leave no public client-side signal on a customer's website, and are marked detectable: false in the fingerprints file by design.

Vendor marketing sites reflect their marketing stack, not their product. outreach.io runs Marketo on its marketing site. apollo.io runs HubSpot plus Intercom. gong.io runs Marketo. The actor reports what the page actually uses, which is the correct outbound-qualification signal. "This company uses Outreach" is not inferable from "outreach.io's marketing site loads Marketo scripts", and no self-domain shortcuts are hard-coded.

Tools behind authenticated pages are unreachable. The actor crawls the homepage and up to two public pages. Dashboards, customer portals and auth-gated paths are not visited.

Heavily obfuscated CDN routing can reduce accuracy. Cookie names and JS global variables are checked as primary signals to partly compensate, but companies fully masking outbound requests through Cloudflare Workers or Fastly with custom domains may still slip through.

LinkedIn Sales Navigator is not detectable and was removed in v0.2.0.

❓ FAQ

Why is uses_clay false on a company I know uses Clay?

Because Clay is backend-only and leaves no client-side signal on its customers' websites. It is marked undetectable in the fingerprints file on purpose. This applies to Salesloft, Instantly, Lemlist and server-side Segment too.

Why did a big enterprise domain come back with everything false?

Almost certainly bot protection serving a stub to headless Chromium. Nothing errors, so detection_error stays false. Flag those for manual review.

Can I trust a negative?

Less than a positive. Presence of a tag is strong evidence; absence is weak, for the three reasons in Known limits.

Does it look at more than the homepage?

Yes, up to two additional public pages such as pricing and product, when crawl_additional_pages is on.

Does one bad domain break a batch?

No. Each row is caught individually, an empty record is pushed with a detection_error_reason, and the batch continues.

🧩 Want other GTM data?

Mamba Labs builds custom actors for B2B go-to-market teams. The public versions of that work live here on the Store, so our users get the same tooling we build under contract.

🧑‍💼 GTM Hiring Signal Scraper	📡 B2B Buying Signals Aggregator
🔑 Job Board Keyword Scanner	🔗 Domain to LinkedIn URL Resolver
🎯 ICP Fit Scorer	📋 Job Posting Monitor
📬 Domain Deliverability Checker	🏢 Company Firmographic Enricher
🌐 Company Social Presence Mapper	🪪 Company Identity Resolver
💰 Funding and Press Signal Scanner	🔄 Company Change-Event Feed
👤 People Finder and Email Verifier	🚀 Prospect Engine
🤖 AI Tooling Detector	📮 Outbound Stack Detector
📝 Publishing Frequency Tracker	✉️ Work Email Waterfall Finder
⏩ Sequencer Lead Push	🏅 Workplace Program Detector
👥 Team Page People Extractor	🧭 Company Discovery List Builder

Every actor in the suite takes a domain or a company and returns one flat row, so they stack in the same Clay table without reshaping anything.

🛠️ Need something custom built for you or your team? Tell us what you are trying to find and we will build it. Talk to Mamba Labs.

🆘 Support

Found a bug or want a tool added to the fingerprints? Open an issue on the Issues tab. Response time is typically within 48 hours.

ℹ️ Sourcing and legal. Detection is done by rendering the company's own public web pages and reading the scripts, cookie names and JS globals they load. No authenticated page is visited and no personal data is collected: the output describes software on a website, not people. You are responsible for how you use the output.

Built by Mamba Labs.