x402-stackdetect

StackDetect: paid x402 website technology / tech stack detection (CMS, frameworks, hosting/CDN, analytics, payments, email and DNS providers) + MCP server

StackDetect: website technology / tech stack detection API for AI agents (x402 + MCP)

What is this website built with? StackDetect looks at one page load of a URL (response headers, cookie names, <meta>, script and stylesheet URLs, inline markers) plus the domain's public DNS (MX, NS, SPF and TXT verification records) and returns the CMS and site builder, ecommerce platform, JS framework, web server, CDN and hosting, analytics and ad pixels, live chat, payments, consent tools, and the email provider, email-sending services, DNS host and verified SaaS. Every technology comes with categories, a version when the site exposes one, a confidence score (0-100) and the evidence that matched.

Built for lead enrichment and sales agents, competitor research, integration planning ("is this a Shopify store?"), and agents that need to know how a site works before reading or automating it.

• Hosted API: https://api.youraitools.co/stackdetect (also at https://stackdetect.agentgate.workers.dev)
• Price: $0.003 USDC per lookup on Base over x402. No API key, no signup. Invalid URLs, unreachable sites and error pages with nothing detectable are never charged.
• Free tier: /v1/preview (technology names and categories, 10/min per IP) and a remote MCP server.
• In-house signature set (MIT), 266 technologies in 38 categories.
• Start here (all our tools, MCP configs, code samples): https://agentgate-source.pages.dev/start/

MCP (Claude Desktop, Cursor, Windsurf, any MCP client)

Remote (free preview tier):

{ "mcpServers": { "stackdetect": { "type": "http", "url": "https://api.youraitools.co/stackdetect/mcp" } } }

Local stdio (this package):

{ "mcpServers": { "stackdetect": { "command": "npx", "args": ["-y", "@agentgate-builder/stackdetect"] } } }

Tool: detect_stack(url). Free by default. For full results (versions, confidence, evidence, DNS-based providers), set STACKDETECT_X402_PRIVATE_KEY to a Base wallet key with a little USDC and add the optional peers:

{ "mcpServers": { "stackdetect": { "command": "npx", "args": ["-y", "-p", "@agentgate-builder/stackdetect", "-p", "@x402/fetch", "-p", "@x402/evm", "-p", "viem", "stackdetect"], "env": { "STACKDETECT_X402_PRIVATE_KEY": "0x..." } } } }

The stdio server only pays the StackDetect pay-to address, on Base, at most $0.005 per call.

Docker: docker build -t stackdetect-mcp . && docker run -i --rm stackdetect-mcp

HTTP

# free preview
curl -s "https://api.youraitools.co/stackdetect/v1/preview?url=https://laravel.com"
# paid (any x402 client): GET ?url= or POST {"url": "..."}
curl -i "https://api.youraitools.co/stackdetect/v1/detect?url=shopify.com"     # 402 + PAYMENT-REQUIRED

import { wrapFetchWithPaymentFromConfig } from '@x402/fetch';
import { ExactEvmScheme } from '@x402/evm';
import { privateKeyToAccount } from 'viem/accounts';
const pay = wrapFetchWithPaymentFromConfig(fetch, { schemes: [{ network: 'eip155:8453', client: new ExactEvmScheme(privateKeyToAccount(process.env.BUYER_KEY)) }] });
const r = await (await pay('https://api.youraitools.co/stackdetect/v1/detect?url=acme.com')).json();
console.log(r.categories.cms, r.providers.email, r.providers.hosting);

Response (trimmed):

{ "tier": "full", "final_url": "https://laravel.com/", "http_status": 200, "technology_count": 14,
  "technologies": [{ "name": "Cloudflare", "categories": ["cdn", "waf"], "version": null, "confidence": 100, "evidence": [{ "type": "header", "value": "server: cloudflare" }] },
                   { "name": "Laravel", "categories": ["web-framework"], "version": null, "confidence": 85, "evidence": [{ "type": "cookie", "value": "laravel_session" }] }],
  "categories": { "web-framework": ["Laravel"], "js-framework": ["Vue.js"] },
  "providers": { "email": ["Google Workspace"], "email_delivery": [], "dns": ["Cloudflare DNS"], "hosting": ["Cloudflare"], "verified_saas": [] } }

Routes

x402 v2 (PAYMENT-SIGNATURE) and v1 (X-PAYMENT). GET, POST and HEAD on the paid route all answer the 402 challenge with the PAYMENT-REQUIRED header. The 402 is answered without any network call.

How it works, and honest limits

• One GET of the URL you pass (redirects followed, 8 s timeout, 1.5 MB cap, private and internal addresses refused, our own hosts refused), plus three DNS-over-HTTPS queries (MX, NS, TXT) on the paid tier. Nothing is stored or logged. Cookie values are never kept, only cookie names.
• The hosted API runs on Cloudflare Workers, whose outbound fetches overwrite the origin's Server header and add cf-ray; those are ignored there, and Cloudflare is detected from the site's IP range instead. So the web-server software (nginx, Apache...) is only reported when another header exposes it.
• No JavaScript is executed: tools injected later by a tag manager can be missed. Sites can hide or fake signals. Domain-verification TXT records can be old.
• One request per call with a clear bot user agent (StackDetectBot). Not a crawler: please don't use it for bulk scraping.

Development

npm install && npm test        # offline tests (fake site, fake DoH, fake facilitator)
npx wrangler deploy            # Cloudflare Worker (free plan; usage counters in a SQLite Durable Object, no KV)
node scripts/live-check.mjs    # no-spend live check of the 402s and the preview

MIT licensed. Part of the agentgate-builder trust kit: AgentGate, WebRead, InjectScan, DomainCheck, PayGuard, PkgGuard, StackDetect. Built by an AI builder agent with human oversight.

agentgate-source: code mirror on Cloudflare Pages. All repos