# Tech Detect

> Domain in, technology stack out. Pay per call in USDC over x402. No signup, no API key, no dashboard.

## What this is

A machine facing API for agents that need to sort websites by what they are built with. One HTTP
request per host, matched against an in-house signature set. Payment happens inside the request:
call the endpoint, receive HTTP 402 with the accepted terms, retry with a signed payment header.

## Endpoints

- POST https://stack.netzhandwerker.de/stack — 0.003 USDC — Identify the technology stack of one website: CMS, shop, framework, JavaScript libraries with version, analytics, consent tool, payment provider, CDN, web server, host, font source, chat and booking widget.

## What comes back

Categories reported on every call: Content management system, Shop system, Web framework, JavaScript library, Analytics, Consent tool, Payment provider, CDN, Web server, Host, Font source, Chat tool, Booking tool.
Every hit carries a name, an optional version where the site exposes one, a confidence value from
0 to 100 and up to three pieces of evidence. Evidence is one of: header, path, signature, meta,
cookie, dns, inference. Nothing is reported without the evidence it rests on.

## Rendering

Off by default. Pass render=true to load the page in a headless browser first. Use it for sites that
build their markup entirely in JavaScript. On the rendered path the response headers of the document
are not available, so header evidence is absent and host evidence comes from DNS only.

## Where the signatures come from

They were written for this service. Wappalyzer closed its fingerprint database in August 2023 and
every continuation of it carries GPL-3.0; BuiltWith and WhatRuns are proprietary. None of them is
used here, directly or indirectly.

## Discovery without payment

- https://stack.netzhandwerker.de/openapi.json
- https://stack.netzhandwerker.de/.well-known/x402
- https://stack.netzhandwerker.de/mcp (Model Context Protocol, tools/list needs no payment)
- https://stack.netzhandwerker.de/pricing
- https://stack.netzhandwerker.de/categories
- https://stack.netzhandwerker.de/health
- https://stack.netzhandwerker.de/readiness

## Rules we follow

- robots.txt of the target origin is respected; a disallowed path is refused and not charged.
- One request per host. No path probing, no admin path scanning, no version guessing by brute force.
- A 401, 402 or 403 from the origin ends the request. No bot wall is bypassed.
- Results are cached for 24 hours per host.
- Private and link local address ranges are refused, so this API cannot be used to reach internal hosts.
- Confidence never reads 100. Pattern matching does not warrant certainty.

## Operator

Die Netzhandwerker, IT-Manufaktur für Digitales und Sensorik. https://netzhandwerker.de