{
  "markdown": "# unstack\n\n**Discover any website's tech stack from a single URL.**\n\nGive Claude a URL. It reads public signals -- HTTP headers, cookies, HTML source, asset URLs, common framework paths -- and pieces together a styled, evidence-backed report. No headless browser. No paid APIs. No authentication. Just a Claude skill and a URL.\n\n---\n\n## What This Does\n\nMost \"what's this site built with\" tools pattern-match against a static database. They'll tell you \"WordPress\" but not *why* they think it's WordPress, and they'll miss the Statamic site running behind Laravel cookies or the Payload CMS hiding behind a Vercel edge layer.\n\nunstack is different. It gives Claude a structured methodology for reading public signals -- five phases of analysis, a library of 100+ detection signatures, and a report template -- then lets the model *reason* about converging evidence instead of checking boxes.\n\n- **Cookie reading** -- Laravel's encrypted `{iv, value, mac, tag}` payload reveals the framework even when every other header is scrubbed\n- **Asset URL patterns** -- Statamic's Glide pipeline, Next.js image optimization, Shopify CDN paths, Sanity's image API -- each has a distinctive URL shape\n- **CSS class recognition** -- `sc-` prefix = styled-components, `css-` = Emotion, Tailwind utilities are unmistakable, `svelte-` hashes don't lie\n- **Absence as signal** -- No analytics scripts? No JS framework? No build artifacts? Those are deliberate architectural decisions worth calling out\n\nThe output is either a full styled HTML report (editorial design, scroll animations, evidence citations) or a quick text summary when you just want answers fast.\n\n---\n\n## Installation\n\n### Claude Code Plugin Marketplace\n\n```\n/plugin marketplace add simplyarun/unstack\n/plugin install unstack@unstack\n```\n\n### Manual Installation\n\nClone into your Claude skills directory:\n\n```bash\ngit clone https://github.com/simplyarun/unstack.git ~/.claude/skills/unstack\n```\n\n---\n\n## Usage\n\n### Full Report\n\n```\n> Audit the tech stack of stripe.com\n> What is vercel.com built with? Give me the full report.\n> Unstack linear.app\n```\n\nProduces a styled HTML report with five sections: Core Stack, Infrastructure, Frontend, Third-Party Services, Privacy & Security -- plus architectural notes.\n\n### Quick Summary\n\n```\n> Quick check -- what's notion.com running?\n> Just tell me what framework github.com uses\n```\n\nReturns a concise text breakdown in chat. No file generated.\n\n### Commonly Detected Technologies\n\n| Category | Examples |\n|----------|----------|\n| CMS / Framework | WordPress, Next.js, Nuxt, Laravel, Django, Rails, Statamic, Craft, Ghost, Astro, Remix |\n| Hosting / CDN | Vercel, Netlify, Cloudflare, AWS CloudFront, Fastly, Fly.io, Render, GitHub Pages |\n| Frontend | React, Vue, Svelte, Angular, Tailwind, styled-components, Emotion, CSS Modules |\n| Analytics | Google Analytics, Segment, Amplitude, PostHog, Plausible, Fathom, Hotjar |\n| Services | Stripe, Intercom, HubSpot, Sentry, LaunchDarkly, Zendesk, Algolia |\n| Security posture | CSP policies, HSTS, CSRF tokens, cookie flags, bot detection |\n\nDetection depends on what signals the site exposes. Sites behind aggressive bot protection or with fully static CDN layers may yield fewer results.\n\n---\n\n## How It Works\n\nThe skill runs five phases: fetch HTTP headers and cookies, analyze HTML source in two passes (structure then patterns), check `robots.txt` and `sitemap.xml`, probe ~10 well-known framework paths for non-404 responses, then synthesize everything against the signature library.\n\nNo single signal is treated as definitive. The value is in the synthesis -- converging evidence across multiple phases. A Laravel-style encrypted cookie alone could be any of a dozen PHP CMSes. But that cookie + Glide image URLs + flat-file sitemap structure + no database-backed admin path = high-confidence Statamic.\n\nThe strongest signals, roughly ranked:\n\n1. **Cookie encryption format** -- survives even when developers strip all other headers\n2. **Asset URL path structure** -- image CDNs and build pipelines each have distinctive shapes\n3. **CSS class naming conventions** -- generated by build tools, not easily changed\n4. **Meta generator tags** -- when present, they're definitive\n5. **Path probe responses** -- `/wp-admin` redirecting or `/_next/data` existing confirms the framework\n\n---\n\n## Architecture\n\n```\nunstack/\n  .claude-plugin/\n    marketplace.json                  # Plugin marketplace catalog\n  plugins/\n    unstack/\n      .claude-plugin/\n        plugin.json                   # Plugin manifest (name, version, description)\n      skills/\n        unstack/\n          SKILL.md                    # Investigation methodology + output mode logic (~180 lines)\n          references/\n            detection-signatures.md   # 100+ fingerprints organized by detection method\n            report-template.html      # Styled HTML template with scroll animations\n```\n\nThe skill follows a **progressive disclosure** pattern. SKILL.md loads on every invocation and contains the five-phase workflow and output mode logic. The detection signature library and report template load on demand -- only when Claude needs to cross-reference patterns or generate a full report. This keeps context lean for quick-answer queries.\n\n---\n\n## Design Choices\n\n**Reasoning over pattern matching.** Static databases go stale. The real value is in an AI that can interpret what it sees -- recognizing that a cookie encryption format implies a specific framework family, or that the absence of analytics scripts is itself a signal. unstack provides the methodology and evidence library, then trusts the model to reason.\n\n**Evidence or silence.** Every technology in the report is backed by a specific, verifiable signal. If there's no header, cookie, URL pattern, or HTML marker to point to, it doesn't appear in the report.\n\n**The report is the product.** The report template draws from Bauhaus design principles: editorial typography (Fraunces serif + Space Grotesk), strict grid discipline, numbered sections, and restrained color. It's meant to be shared, not just read and discarded.\n\n---\n\n## Limitations\n\nunstack reads what's publicly visible. That means it has blind spots:\n\n- **Aggressive bot protection** -- Sites using Cloudflare's Under Attack mode or similar challenges may block `curl` entirely, returning a CAPTCHA page instead of real headers.\n- **SPAs behind CDN proxies** -- If all HTML is generated client-side and the CDN strips server headers, there are fewer signals to work with. Detection still works but may miss backend technologies.\n- **Obfuscated or stripped headers** -- Some sites actively remove `x-powered-by`, custom cookies, and other identifying headers. Cookie encryption format is harder to strip, but not impossible.\n- **Rate limiting** -- The ~10 path probes are lightweight, but some WAFs may flag even that. If a site returns 403 on everything, path probing yields nothing.\n- **Ground truth is unknowable** -- unstack reports what it can detect, not what actually exists. A site might use Redis, PostgreSQL, and Kafka internally, but none of that is visible from public signals.\n\n---\n\n## Smoke Test Results\n\nTested against 4 sites with different stacks (WordPress, Next.js/Vercel, React SPA, Statamic/Laravel). Each site was audited with and without the skill to measure what the skill actually adds.\n\n**What the skill consistently improves:**\n\n- **Evidence specificity** -- With the skill, every finding cites the exact header, cookie, or URL pattern. Without it, Claude often identifies the right technology but infers from general knowledge rather than observed signals.\n- **Report consistency** -- The skill produces a predictable, styled HTML report every time. Without it, formatting and depth vary randomly.\n- **Detection coverage** -- The structured five-phase approach catches signals that ad hoc analysis skips, particularly cookie encryption formats and CSS class naming patterns.\n\n**What the skill costs:** ~2x tokens and time compared to asking Claude the same question without the skill. The overhead comes from the multi-phase methodology and report template population.\n\nThis is a small smoke test, not a comprehensive benchmark. Contributions of additional test sites are welcome.\n\n---\n\n## Requirements\n\n- Claude Code, Claude Desktop (Cowork mode), or any Claude environment that supports skills\n- Internet access (for fetching headers and page content)\n- `curl` available in shell (standard on macOS/Linux)\n\nNo API keys. No external dependencies. No build step.\n\n---\n\n## Credits\n\nBuilt by [@simplyarun](https://twitter.com/simplyarun). Report design inspired by Bauhaus grid principles.\n\n## License\n\nMIT\n",
  "bytes": 8684,
  "sha": "212bbca9b35afc816f608cea58065083ae91dabb20f5b9d71f90f39872f0e759",
  "repo_slug": "simplyarun/unstack",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/plg_simplyarun_unstack_unstack_e9c288ba/readme"
}