Tech stack detection

Detect the technology stack of a public website: CDN, web server, language/runtime, frontend framework (Next.js, Nuxt, SvelteKit, Remix, Astro, React, Vue, Angular), CMS (WordPress, Drupal, Ghost, Shopify, Wix, Squarespace, Webflow), analytics (GA, GTM, PostHog, Mixpanel, Segment, Hotjar, Plausible, Fathom), and payments (Stripe, PayPal). Signature-based; no third-party API.

Input

Example output

{
  "url": "https://example.com/",
  "detected": [
    {
      "category": "server",
      "name": "nginx"
    }
  ],
  "byCategory": {
    "server": [
      "nginx"
    ]
  },
  "generator": null,
  "server": "nginx",
  "poweredBy": null,
  "fetchedAt": "2026-06-19T22:00:00.000Z"
}

Try it - see the 402 challenge (free)

curl -i -X POST https://agent402.tools/api/tech-stack \
  -H "Content-Type: application/json" \
  -d '{"url":"https://example.com"}'

The response is HTTP 402 Payment Required with exact payment requirements. Any x402 v2 client pays automatically and retries:

Paid call (JavaScript agent)

import { wrapFetchWithPayment } from "@x402/fetch";
import { x402Client } from "@x402/core/client";
import { registerExactEvmScheme } from "@x402/evm/exact/client";
import { privateKeyToAccount } from "viem/accounts";

const client = new x402Client();
registerExactEvmScheme(client, { signer: privateKeyToAccount(KEY) });
const payFetch = wrapFetchWithPayment(fetch, client);

const res = await payFetch("https://agent402.tools/api/tech-stack", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
    "url": "https://example.com"
  }),
});

Part of these workflows

This tool is one step in 5 curated multi-tool workflows - agents can fetch the whole sequence as an MCP prompt or call https://agent402.tools/api/skill-packs/{slug}/prompt.

• Security audit - Enumerate a domain's external attack surface in one workflow: certs, DNS posture, email auth, HTTP security headers, and tech stack.
• Fraud signals - Is this domain trustworthy, or is it a phishing site / typosquat / scam? Pull the reputation signals an analyst checks before clicking anything: domain age, cert issuance history, hosting reputation, DNS topology, tech-stack fingerprint, and page-content red flags. Different from a security audit - this is about whether the domain is what it claims to be.
• Domain intel - Full domain security and SEO intelligence in one call: WHOIS, DNS, TLS cert, HTTP headers, tech stack, robots policy, and certificate transparency.
• Competitor scan - What's a competitor using? Tech stack, HTTP headers, WHOIS, and page metadata in one call.
• Entity enrichment - Company name → verified identity + web footprint dossier: Wikidata facts, the official LEI legal-entity record, the SEC EDGAR filer, domain registration, tech stack, and brand favicon - in one pass.

Related tools