Opentechalyzer

Free, open source website technology detection. No subscription, no API key, no per-lookup credits.

Point it at any URL and it tells you what the site is built with, who they buy software from, how to contact them, what security posture they have, and which known CVEs affect their stack. Point it the other way and it tells you every site running a given technology.

Runs as a CLI, a TypeScript library, and an MCP server so Claude, Claude Code, Codex, ChatGPT and Cursor can use all of it directly.

npx opentechalyzer stripe.com

Cost: everything runs on your machine. No hosted service, no account, no API key, nothing to pay. The single exception is ota reverse, which queries a public dataset on your own Google Cloud project and is free under Google's 1 TB monthly allowance.

---

Contents

• What you get
• Install
• Commands
• Enrichment field sets
• Use it from Claude, ChatGPT, Codex
• Library API
• Output formats
• Reverse lookup
• What it detects
• How it works
• Accuracy benchmark
• What it cannot do
• Contributing

---

What you get

| Capability | Command | What comes back | | --- | --- | --- | | Full tech stack of a URL | ota example.com | 588 fingerprints across 55 categories, each with a confidence score and the evidence behind it | | Bulk lookup | ota -i domains.txt -f csv -j 10 | One row per technology per URL. Thousands of domains, no rate limit, no credits | | Contact details | ota example.com --crawl --fields contact | Emails, phone numbers, WhatsApp, found by crawling contact and about pages | | Social handles | --fields social | X, LinkedIn, Instagram, Facebook, YouTube, TikTok, GitHub, Pinterest | | Company info | --fields company | Name, locations, founding year, description, from structured data | | Security posture | --fields security | TLS certificate, issuer, expiry, plus SPF, DMARC, DKIM and CAA records | | Software spend estimate | --fields signals | A floor estimate in USD/month, itemised by the paid tools detected | | Traffic rank | --fields signals | Popularity rank via the free Tranco list | | Locale | --fields locale | Language, all languages served, country, currencies | | Metadata | --fields meta | Title, description, copyright year, schema.org types, keywords | | Known CVEs | ota cve example.com | CPE identifiers mapped to live CVE data from NVD | | Subdomains | ota subdomains example.com | Certificate transparency plus DNS probing, each result resolve-checked | | Email verification | ota verify sales@example.com | SMTP check without sending. safe / risky / invalid, plus catch-all and role flags | | Change tracking | ota watch example.com | Diff against a stored baseline. Run on a cron for buying-signal alerts | | Reverse lookup | ota reverse --tech Shopify | Every site running a technology, via HTTP Archive | | Compare two sites | MCP compare_tech_stacks | Shared / only-A / only-B | | Markdown report | ota example.com -f markdown | Tables grouped by category, ready to paste into a doc |

Every detection carries an auditable evidence trail. Run with --verbose and you see exactly which header, cookie, DOM selector or npm dependency triggered each result.

---

Install

npm install -g opentechalyzer

Or without installing:

npx opentechalyzer example.com

Requires Node 18.17 or newer. Two optional add-ons unlock more, both free and one-time:

npm i playwright && npx playwright install chromium

opentechalyzer db import && opentechalyzer db import-tranco

| Add-on | Unlocks | Why bother | | --- | --- | --- | | Playwright | --render | Roughly doubles what is found. Tag managers, injected widgets and framework globals only exist after JavaScript runs | | db import | Wider fingerprint coverage | Merges a community dataset for long-tail technologies | | db import-tranco | trafficRank | Popularity ranking from the free Tranco research list |

---

Commands

Scan a site

ota example.com                                    # quick scan
ota example.com --render                           # + JS-injected technologies
ota example.com --crawl                            # + inner pages (checkout, contact, about)
ota example.com --sourcemaps                       # + exact npm dependencies from sourcemaps
ota example.com --fields all --verbose             # everything, with evidence
ota example.com --only cms,payment,analytics       # just the categories you care about

Bulk lookup

ota -i domains.txt -f csv -j 10 > stacks.csv
ota -i domains.txt --fields contact,social -f csv -j 10 > enriched.csv

One domain per line, # for comments. Failures are reported per URL on stderr, so one dead host never aborts a batch of thousands. Bare apex domains that only serve www are retried automatically, and the substitution is recorded as a warning.

Subdomain discovery

ota subdomains example.com
ota subdomains example.com -f json

Combines certificate transparency logs with DNS probing of common labels, then resolves every result so dead entries are marked rather than silently included. Often surfaces internal tooling that is not linked from anywhere: grafana., jenkins., metabase., argocd., vault.

Email verification

ota verify sales@example.com
ota verify a@x.com b@y.com --dns-only

Validates syntax, resolves MX, then opens an SMTP session and issues RCPT TO without ever sending DATA. Nothing is delivered. Returns safe / risky / invalid / unknown plus catch-all, role-account, disposable and free-provider flags.

Two honest caveats, both reported in the result rather than hidden. Most networks block outbound port 25, in which case the verdict is unknown and not a false negative, so use --dns-only there. And catch-all domains accept every address, so acceptance proves the domain works, not that the mailbox exists; those are always reported risky, never safe.

Vulnerability lookup

ota cve example.com
NVD_API_KEY=... ota cve example.com     # free key raises the rate limit

Maps detected technologies to CPE identifiers and queries the public NVD database. Technologies without a confidently detected version are skipped rather than matched against every release ever published, because that would produce a long and meaningless list.

Change tracking

ota watch example.com        # first run stores a baseline
ota watch example.com        # later runs report what changed
ota watch --list

Reports technologies added, removed or version-changed since the last run. Snapshots are stored locally; nothing is uploaded. Put it on a cron for competitor buying signals, for example a competitor adding Klaviyo or dropping Shopify Plus.

Reverse lookup

ota reverse --tech Shopify --tech Klaviyo --rank 100000

See the full section below.

Database management

ota db status              # what is installed
ota db import              # wider fingerprint coverage
ota db import-tranco       # traffic ranking

Full flag reference

| Flag | Effect | | --- | --- | | -r, --render | Headless browser render. Needs playwright | | -s, --sourcemaps | Parse sourcemaps for exact npm dependency names | | -w, --crawl [n] | Follow up to n internal pages, default 5 | | -F, --fields <sets> | Enrichment sets, comma separated, or all | | -c, --certs | Certificate transparency subdomain lookup | | --intrusive | Include probes for /.git/HEAD and /.env | | --no-dns --no-probe --no-favicon --no-css | Skip individual collectors | | --no-external | Ignore any imported external database | | -f, --format <fmt> | text json markdown csv summary | | -o, --only <cats> | Restrict output to categories | | -m, --min <n> | Minimum confidence, default 25 | | -v, --verbose | Show the evidence behind every detection | | -q, --quiet | Suppress progress output | | -t, --timeout <ms> | Per-request timeout, default 15000 | | -j, --jobs <n> | Concurrency for multiple URLs, default 5 | | -i, --input <file> | Read newline-separated URLs from a file | | -A, --user-agent <ua> | Override the User-Agent | | --categories | List all 55 categories |

---

Enrichment field sets

Pass with --fields, comma separated, or all.

| Set | Fields returned | | --- | --- | | meta | title, description, copyright, copyrightYear, schemaOrgTypes | | keywords | Content keywords, declared plus frequency-derived | | company | companyName, inferredCompanyName, about, locations, companyFounded | | contact | email, phone, whatsapp | | social | x, facebook, instagram, linkedin, github, youtube, tiktok, pinterest | | locale | language, languages, ipCountry, ipCountries, currencies | | security | certInfo (org, country, issuer, protocol, expiry, altNames), dns.spf, dns.dmarc, dns.dkim, dns.caa | | signals | technologySpend, technologySpendMonthlyFloorUsd, spend drivers, trafficRank, trafficLevel |

Pair --fields contact,social with --crawl. Contact details and social handles live on contact and about pages, essentially never on the homepage.

companyName comes from structured data and is trustworthy. inferredCompanyName is a best guess from the page title and is labelled as such, because the difference matters when it feeds a CRM.

---

Use it from Claude, ChatGPT, Codex

Opentechalyzer speaks MCP, so any MCP client gets all eleven tools.

Claude Code

claude mcp add opentechalyzer -- npx -y opentechalyzer-mcp

Claude Desktop, in claude_desktop_config.json:

{
  "mcpServers": {
    "opentechalyzer": {
      "command": "npx",
      "args": ["-y", "opentechalyzer-mcp"]
    }
  }
}

Codex CLI, in ~/.codex/config.toml:

[mcp_servers.opentechalyzer]
command = "npx"
args = ["-y", "opentechalyzer-mcp"]

Cursor, Windsurf and Zed take the same command/args pair in their own MCP config.

ChatGPT and claude.ai (browser clients)

These run in a browser and cannot spawn a local process, so the stdio command above will not work for them. They need a reachable HTTPS endpoint:

opentechalyzer-mcp --http --port 3000

Expose it and register the resulting https://<your-url>/mcp as a connector:

cloudflared tunnel --url http://localhost:3000

GET /health returns server status, handy for checking a tunnel is live.

The HTTP endpoint is unauthenticated. Anyone who discovers the URL can run scans through your machine. Keep it behind a tunnel you control, put auth in front of it, or shut it down when you are finished. Do not park it on a public IP.

| Client | Transport | Works | | --- | --- | --- | | Claude Code | stdio | Yes | | Claude Desktop | stdio | Yes | | Codex CLI | stdio | Yes | | Cursor / Windsurf / Zed | stdio | Yes | | ChatGPT (Developer Mode) | HTTP | Yes, via --http and a public HTTPS URL | | claude.ai (Custom Connectors) | HTTP | Yes, via --http and a public HTTPS URL |

The eleven MCP tools

| Tool | What it does | | --- | --- | | detect_tech_stack | Full stack of one URL, with confidence and evidence | | detect_tech_stack_batch | Up to 25 URLs concurrently | | compare_tech_stacks | Two sites diffed into shared / only-A / only-B | | tech_stack_report | Full markdown report | | reverse_lookup | Every site using a technology, via HTTP Archive | | find_subdomains | Certificate transp