StackPrism — Web Tech Stack Detector

Collects clues from 6 dimensions — runtime globals, DOM, resource URLs, response headers, dynamic loading, and JS copyright comments — to identify and categorize the technologies powering any website.

简体中文 · English · 繁體中文 · 日本語 · Français · Deutsch · Português · Italiano · Čeština · Polski

Introduction • Features • Rule System • Caveats • Contributing • Sponsors • Star History • License

Introduction

StackPrism is a Manifest V3 browser extension for Chrome, Edge, and Firefox that identifies the tech stack used by any webpage.

Unlike most similar tools that only scan HTML resource URLs, StackPrism runs 4 independent detection channels in parallel:

• Static scan — on page load, an injected script scans the DOM, globals, CSS class names, CSS variables, and <meta> tags
• Response header observation — a Service Worker listens to webRequest.onHeadersReceived and captures response headers and HTTP version for the main document, XHR requests, and iframes
• Dynamic resource monitoring — a content script uses PerformanceObserver + MutationObserver to accumulate scripts, styles, iframes, and feeds loaded after user interaction
• JS copyright comment scanning — the background asynchronously fetches the first few hundred bytes of main bundles to identify third-party dependencies packed into index/main/vendor chunks via their copyright headers

Results from all 4 channels are merged and deduplicated, grouped into 50+ categories, with active suppression of spoofed headers, self-referential detections, and fuzzy false positives.

Technical Highlights

• MV3 service worker architecture — no persistent background process; event-driven, low memory footprint
• Rules as data — 50+ JSON rule files (public/rules/) maintained centrally; at build time a precompiler injects __hints (top-3 longest literal segments) and __keywordCombined (merged regex) into each leaf rule, so the runtime only evaluates candidate matches

Detection Coverage

Dimension	Category examples
Frontend	Frontend frameworks / UI frameworks / Frontend libraries / Build & runtime
Backend	Web servers / Backend frameworks / CDN & hosting / Languages
Content	CMS / Themes & templates / E-commerce / RSS
Third-party	SaaS / APM / AI models / Social login / Payments
Marketing	Ads / Marketing / Analytics / Tag managers
Security	WAF / HTTPS / HTTP/2 / HTTP/3 / CSP / Cookie consent

UI Languages

The popup and settings page are available in 9 languages, auto-detected from your browser locale:

🇨🇳 简体中文 · 🇹🇼 繁體中文 · 🇯🇵 日本語 · 🇫🇷 Français · 🇩🇪 Deutsch · 🇧🇷 Português · 🇮🇹 Italiano · 🇨🇿 Čeština · 🇵🇱 Polski

You can also switch the language manually with the 🌐 button in the popup header.

Installation

Load from source (developer mode):

git clone https://github.com/setube/stackprism.git
cd stackprism
bun install
bun run build            # Chrome / Edge
bun run build:firefox    # Firefox

Chrome / Edge:

1. Open chrome://extensions or edge://extensions
2. Enable "Developer mode" in the top-right corner
3. Click "Load unpacked" and select the dist/ directory
4. Visit any webpage — the extension icon shows the detection count

Firefox:

1. Open about:debugging#/runtime/this-firefox
2. Click "Load Temporary Add-on" and select dist-firefox/manifest.json
3. Or run bun run build:firefox and double-click the .xpi in release/

Development

bun run dev           # Dev mode + HMR
bun run typecheck     # vue-tsc type checking
bun run lint          # ESLint
bun run build         # Production build (includes rule precompilation)
bun run build:firefox # Firefox build + .xpi packaging
bun run docs:dev      # VitePress docs preview

Rule System

StackPrism's detection is data-driven — almost all changes require only editing the JSON rule files, not touching any code.

• Index — public/rules/index.json lists all rule files to load
• Page rules — public/rules/page/*.json handle page source, DOM, resource URLs, and dynamic resources
• Header rules — public/rules/headers/*.json handle server response headers and cookies
• Self-suppression — public/rules/self-host-suppress.json skips same-name detection when viewing a major tech site
• Tech links — public/tech-links.json maps tech names to their official URL so results are clickable
• Build-time prefilter — precompileRulesPlugin in vite.config.ts injects __hints and __keywordCombined into each leaf rule at build time; the runtime rule-matcher.ts uses them as candidate filters

Rule schema:

{
  "name": "My Technology",
  "category": "Frontend Framework", // one of 50+ categories
  "patterns": ["regex-or-keyword"],
  "matchType": "regex", // or "keyword"
  "matchIn": ["html", "resources", "url", "headers", "dynamic"],
  "confidence": "高", // 高 / 中 / 低  (high / medium / low)
  "kind": "description",
  "selectors": ["CSS selector"],
  "globals": ["window global name"],
  "classPrefixes": ["class-prefix"]
}

Rule Quality Guidelines

• Prefer high-signal evidence: response headers, unique resource URLs, <meta name="generator">, window.<global>, unique CSS selectors, copyright comments, official SDK package names
• Avoid short or broad keywords (spring, phoenix, column, container — these match competitor mentions, Bootstrap/Tailwind utility classes, and generic prose)
• Prefer narrower matchIn scopes — use resources / url / headers rather than bare html to reduce false positives from page text

Caveats

• Backend detection is not exhaustive — many sites hide Server / X-Powered-By headers; backend results are shown as "clues + confidence"
• Spoofed headers — the extension actively detects scenes where ≥4 distinct identity headers coexist (suggesting a honeypot or spoofed response) and downgrades those categories to low confidence with a warning. Single spoofed headers cannot be detected, so use the clues alongside other signals
• Reload required on first install — the service worker needs to observe the main document response headers, which only works on a fresh page load
• Source search is a DOM snapshot — based on the current page's outerHTML, not the original server-returned HTML
• Chrome system pages / store pages / internal pages generally block content script injection
• Dynamic monitoring accumulates asynchronously — the content script accumulates resources loaded after user interaction; reopening the popup shows the merged result

Contributing

StackPrism ships 2000+ detection rules across 50+ categories, but the frontend ecosystem moves fast. New frameworks, new SaaS tools, false positives, and missed detections are all welcome:

• Bug / false positive / missed detection — Issues — the popup's "Report inaccurate detection" button auto-fills the issue template
• Rule contributions — click "Submit rule contribution" in Settings, or send a PR directly to public/rules/
• Discussion and proposals — Discussions

Before submitting code, run bun run typecheck && bun run lint && bun run build and make sure all three pass.

Star History

If this is useful, a ⭐ helps others find the project.

License

MIT.

LINUX DO Community

Thanks to the Linux.do community for its support and contributions.