Detectzestack Mcp

io.github.mlugo-apxPublished by GitHub account mlugo-apxv1.1.1Updated Oct 25, 2026

Detect any website's tech stack, security headers, SSL, DNS and CVEs via DetectZeStack.

VerifiedSTDIODesktop onlyWeb Search & ScrapingSecurity & Monitoring

Overview

AI-generated overview

Local MCP server that lets an assistant inspect any website's technology stack, security headers, SSL certificate, DNS records and known vulnerabilities via the

What you can do
Detect and check technologies on a site, and find domains using a given technology (detect_tech_stack, check_technology, lookup_by_technology). Grade security headers and inspect SSL/TLS certificate details (check_security_headers, check_ssl_certificate). Look up DNS records plus email security such as SPF, DMARC and DKIM (dns_lookup). Scan for CVE/CPE vulnerabilities and compare the stacks of 2 to 10 sites (scan_vulnerabilities, compare_stacks). Build a combined site profile on higher plans (site_profile).
When to use it
Useful when you want an assistant to profile a website's stack, audit its security headers or certificate, check DNS and email security settings, or look for known vulnerabilities, without leaving the chat.
Requirements
Runs locally via npx (Node.js). Needs one API key set as an environment variable: RAPIDAPI_KEY, APIMARKET_KEY or DETECTZESTACK_API_KEY; provider priority is RAPIDAPI_KEY, then APIMARKET_KEY, then DETECTZESTACK_API_KEY. A free direct key gives 100 requests per month; paid plans raise the quota. Network access to the DetectZeStack service is required.
Before you install
Each tool call consumes request credits against a monthly quota; site_profile costs 3 credits and compare_stacks costs 1 per URL, and paid plans involve spending money. The API key is a secret passed in the environment. Queries about target sites are sent to the third-party DetectZeStack service.

Installation

In SourceWeft

  1. Open Detectzestack Mcp in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

DetectZeStack MCP Server

An MCP (Model Context Protocol) server that lets AI agents detect technology stacks, analyze security headers, inspect SSL certificates, look up DNS records, and scan for vulnerabilities on any website.

Quick Start

Claude Code

Add to .mcp.json in your project root (or ~/.claude/.mcp.json for global):

json
{  "mcpServers": {    "detectzestack": {      "command": "npx",      "args": ["-y", "detectzestack-mcp"],      "env": {        "RAPIDAPI_KEY": "your-rapidapi-key"      }    }  }}

Cursor

Add to .cursor/mcp.json in your project:

json
{  "mcpServers": {    "detectzestack": {      "command": "npx",      "args": ["-y", "detectzestack-mcp"],      "env": {        "RAPIDAPI_KEY": "your-rapidapi-key"      }    }  }}

Windsurf

Add to ~/.codeium/windsurf/mcp_config.json:

json
{  "mcpServers": {    "detectzestack": {      "command": "npx",      "args": ["-y", "detectzestack-mcp"],      "env": {        "RAPIDAPI_KEY": "your-rapidapi-key"      }    }  }}

Get Your API Key

Either:

Alternative API Providers

Instead of RapidAPI, you can use API.market or a direct API key:

API.market:

json
{  "mcpServers": {    "detectzestack": {      "command": "npx",      "args": ["-y", "detectzestack-mcp"],      "env": {        "APIMARKET_KEY": "your-apimarket-key"      }    }  }}

Direct API Key:

json
{  "mcpServers": {    "detectzestack": {      "command": "npx",      "args": ["-y", "detectzestack-mcp"],      "env": {        "DETECTZESTACK_API_KEY": "your-api-key"      }    }  }}

Provider priority: RAPIDAPI_KEY > APIMARKET_KEY > DETECTZESTACK_API_KEY

Available Tools

ToolDescriptionCredits
detect_tech_stackDetect all technologies on a website1
check_technologyCheck if a site uses a specific technology1
lookup_by_technologyFind domains using a specific technology1
check_security_headersGrade security headers (A+ to F)1
check_ssl_certificateInspect SSL/TLS certificate details1
dns_lookupDNS records + email security (SPF/DMARC/DKIM)1
scan_vulnerabilitiesCVE/CPE vulnerability scan1
compare_stacksCompare tech stacks of 2-10 sites1 per URL
site_profileFull combined profile (Ultra+ plan)3

Example Prompts

Once configured, ask your AI agent:

  • "What technologies does stripe.com use?"
  • "Does shopify.com use React?"
  • "Check the security headers of my-site.com"
  • "Is the SSL certificate for example.com about to expire?"
  • "Look up DNS records for gmail.com"
  • "Scan my-app.com for known vulnerabilities"
  • "Compare the tech stacks of stripe.com and square.com"
  • "Give me a full site profile of github.com"

Pricing

PlanRequests/MonthPrice
Basic100Free
Pro1,000$9/mo
Ultra10,000$29/mo
Mega50,000$79/mo

View pricing (same plans on RapidAPI)

Links

License

MIT

Source: README.md at commit 0d1fc55

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v1.1.1LatestSep 27, 2026

Score

40% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.