Tech Stack Teardown

Tech Stack Teardown

Detect a company's GTM stack from public signals — keyless-first, four independent detection signals, merged into one profile. No single layer sees everything: raw HTML misses tag-manager-injected tools, headers reveal CDN/platform/cookies that HTML hides, the rendered browser sees every third-party request and window global, and DNS doesn't lie about who sends a company's mail. The scripts collect and merge deterministically; you, the agent, write the narrative report from the unified profile + motion inference.

The four detection signals

Account/pixel-ID extraction & attribution fingerprint (v2.1.0)

Detecting the vendor is table stakes; the high-value move is pulling the specific account/pixel ID a vendor's snippet exposes. ~29 high-value technologies now carry an id_pattern (a capture-group regex run against raw + rendered HTML and request URLs). Every extracted ID is collected into an attribution fingerprint in the JSON and a dedicated markdown section.

Why it matters — cross-company attribution: IDs are stable and often shared.

• Two domains loading the same GTM-XXXX container or G-XXXX GA4 stream are almost certainly the same owner, agency, or parent company (one team manages both tags).
• A shared Meta Pixel ID links a brand's microsites / landing-page domains / shadow funnels.
• A HubSpot portal ID ties together every property a single HubSpot account powers.
• Run a teardown on each domain, then grep the attribution_fingerprint.flat lists for an intersection — any shared tech=value is a strong ownership link.

An id_pattern hit is itself strong evidence the tech is present, so an ID match alone promotes the tech into the detected stack (even if no request-domain/global signal fired).

# extract IDs (keyless, source layer only):
python3 ${SKILL_DIR}/scripts/source_inspect.py --domain example.com | jq '.account_ids'

# full teardown surfaces the fingerprint in JSON (.attribution_fingerprint) and the .md report:
python3 ${SKILL_DIR}/scripts/teardown.py --domain example.com --no-render --md ${WORKSPACE}/ex.md
jq -r '.attribution_fingerprint.flat[]' ${WORKSPACE}/ex.json   # compare across domains

Account/pixel-ID format cheat-sheet

Only public, client-side IDs are extracted (e.g. Stripe publishable pk_live_, never a secret key). These are values any visitor's browser already sees.

When to use

• "What tools does [company] use?" / "Tear down [company]'s sales & marketing stack."
• "Are these two domains run by the same company/agency?" — compare attribution fingerprints.
• "What's [company]'s GTM motion?" — the motion-inference layer answers this from the stack.
• "Is [company]'s email sending compliant?" (SPF/DKIM/DMARC + blacklist assessment).
• Competitive/prospect recon, deliverability assessment, batch profiling, change-tracking a target.

How to run

One-shot (recommended): the orchestrator

teardown.py runs all four signals, merges them, infers the GTM motion, and emits JSON + markdown.

# keyless, full (DNS + source + headers + rendered). Rendered layer auto-skips if Playwright absent.
npx playwright install chromium     # one-time, enables signal #3
python3 ${SKILL_DIR}/scripts/teardown.py --domain example.com \
  --json ${WORKSPACE}/example.json --md ${WORKSPACE}/example.md

# fastest keyless mode (skip the browser layer):
python3 ${SKILL_DIR}/scripts/teardown.py --domain example.com --no-render \
  --json ${WORKSPACE}/example.json

Flags: --no-render (skip Playwright), --no-dns, --no-blacklist, --render-wait <ms>. For a batch, loop per domain and have the agent build the comparison table.

Change tracking (snapshot / diff)

# week 1 — save a snapshot:
python3 ${SKILL_DIR}/scripts/teardown.py --domain example.com --no-render \
  --snapshot ${WORKSPACE}/example_w1.json --json -

# week 2 — diff against it (added/removed tools + motion shifts):
python3 ${SKILL_DIR}/scripts/teardown.py --domain example.com --no-render \
  --diff ${WORKSPACE}/example_w1.json --json ${WORKSPACE}/example_w2.json

Run a single signal (for targeted recon)

python3 ${SKILL_DIR}/scripts/source_inspect.py --domain example.com   # signal 1
python3 ${SKILL_DIR}/scripts/fetch_headers.py  --url    example.com   # signal 2
node    ${SKILL_DIR}/scripts/detect_requests.mjs --url https://example.com --wait 5000  # signal 3
python3 ${SKILL_DIR}/scripts/dns_scan.py --domain example.com         # signal 4

All four read the bundled ${SKILL_DIR}/scripts/signatures.json (200+ technologies). Pass --signatures <path> to override.

GTM motion inference

teardown.py reads the merged stack and infers the go-to-market motion(s), each with matched tools + a confidence score:

Optional enrichment (paid — not required)

The four keyless signals already produce a strong profile (and the 202-sig DB + ID extraction cover the high-value GTM stack). For long-tail breadth — obscure / dynamically-loaded tech the bundled DB may miss — an optional Wappalyzer-style Apify actor can be layered in when APIFY_API_TOKEN is set. Enrichment only; keyless-first is always primary and the skill never depends on it.

# bundled helper — gated on APIFY_API_TOKEN; prints a clean "skipped" record (exit 0) without it.
# Uses a PUBLIC Apify Store technology-profiler actor (override with --actor user/actor-name):
APIFY_API_TOKEN=... python3 ${SKILL_DIR}/scripts/apify_profiler.py --url example.com \
  --output ${WORKSPACE}/example_apify.json

# or fold it straight into the orchestrator (adds Apify-only techs as a low-confidence layer):
APIFY_API_TOKEN=... python3 ${SKILL_DIR}/scripts/teardown.py --domain example.com --apify \
  --json ${WORKSPACE}/example.json

apify_profiler.py normalizes the actor's varied output shapes into {detected:[{name, category}]}. The default actor is a public Store profiler; pick any public technology-profiler actor you trust via --actor or APIFY_TECH_ACTOR. A BuiltWith lookup (BUILTWITH_API_KEY) is an alternate profiler you can layer in the same way.

Report (you, the agent)

teardown.py --md writes a structured markdown teardown (motion inference → detected stack by category with evidence/confidence → email-auth & deliverability → collection notes). For a single domain that's often enough; enrich it with: public complaint/stack-mention web search ("[domain]" spam OR blacklist, "[company]" + tool names), and for batches a comparative summary table across domains.

Outputs

• ${WORKSPACE}/*.json — the unified profile (detected stack with per-tech account_id/ account_ids, by-category, motion inference, attribution_fingerprint, raw per-signal data) and any per-signal JSON.
• ${WORKSPACE}/*.md — the markdown teardown (orchestrator-generated; agent enriches).
• ${WORKSPACE}/*_snap.json — saved snapshots for --diff change tracking.

Credentials / env

• Required: none. All four signals are keyless. dig (bind/dnsutils) must be on PATH for the DNS layer; Playwright chromium (npx playwright install chromium) enables signal #3 — if absent, the rendered layer auto-skips and the other three still run.
• Optional: APIFY_API_TOKEN / BUILTWITH_API_KEY — enrichment-only technology profiler. Free mode already yields a strong report.

Cheat-sheet reference tables

Common SPF includes → sender

Common DKIM selectors → tool

High-value vendor request-domains (rendered layer)

Notes & edge cases

• DNS is the highest-signal email layer — SPF/DKIM "don't lie." Lead detection from it.
• Wildcard _domainkey: some domains answer every DKIM selector. dns_scan.py probes a random selector first; if it resolves, it sets dkim_wildcard:true and suppresses the (meaningless) per-selector tool map. Trust SPF/MX/TXT instead for those domains.
• "SPF shows Google only but they use Smartlead/Instantly" is normal — those relay through Google Workspace via SMTP. Confirm via open.sleadtrack.com in TXT/source or a separate cold-outbound domain (dns_scan.py probes get[brand].com/try[brand].com-style variants).
• Confidence: combines independent signals; multi-layer corroboration (e.g. rendered+source) bumps it. request_domain/global_js/meta_generator are strong; bare html substrings are weak.
• "No tools detected" can mean early-stage or tools that leave no public trace (Sales Nav, Clay, Apollo-for-prospecting) — say so rather than implying none exist.
• Parked/for-sale domains (wildcard DNS, Afternic redirect) — try .co/.com/.io variants.
• The rendered layer needs Chromium; for batches > ~10 domains it dominates runtime — use --no-render for a fast keyless pass, then re-render only the domains that warrant it.