BuiltWithSAFE
BuiltWith MCP Server
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Domain API v25
Domain lookups now use API v25. Technology records include numeric confidence scores from 0 to 1. Full JSON responses include Meta.company_reg, an array of company registration records with string type and number fields; registration numbers preserve leading zeros. The array is empty when unavailable or metadata is excluded. See the API reference. Full domain methods preserve both fields; live technology lookups include confidence and return technology records only.
🌟 Overview
BuiltWith MCP is a Model Context Protocol (MCP) server that allows AI assistants (Claude, Cursor, IDE agents, etc.) to query BuiltWith’s technology detection data directly and natively.
It enables natural-language questions like:
“What technologies does example.com use?” “Does this site run Shopify or Magento?” “What analytics stack is used by nytimes.com?”
BuiltWith MCP supports bring-your-own BuiltWith API key and can be used either as a hosted service or self-hosted.
Claude DEMO
Shows how to get this working in Claude as a Connector
https://github.com/user-attachments/assets/1199362a-c813-497e-8569-15b9a3ce9713
🌐 Hosted MCP (Recommended)
BuiltWith provides a hosted MCP endpoint — no local Node process required.
Endpoint
https://api.builtwith.com/mcp
Authentication
Bring your own BuiltWith API key:
Authorization: Bearer YOUR_BUILTWITH_API_KEY
Example MCP request
{
"jsonrpc": "2.0",
"id": 1,
"method": "tools/list"
}🧩 Supported Tools
The hosted MCP exposes the following tools:
domain-lookup– Live technology detection for a domaindomain-api– Full domain metadatachange-api– Technology additions and removals with business contextlists-api– Sites using a technology, includingOTHERTECHSand numeric attribute filters such asSPEND,REVENUE, andEMPLOYEES
a0fb0c20668fOBSERVED · 2026-10-08Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add mcp-server --env BUILTWITH_API_KEY=${BUILTWITH_API_KEY} -- npx -y @builtwith/[email protected]{
"mcpServers": {
"mcp-server": {
"command": "npx",
"args": [
"-y",
"@builtwith/[email protected]"
],
"env": {
"BUILTWITH_API_KEY": "${BUILTWITH_API_KEY}"
}
}
}
}Exposed tools (13)
12 read · 1 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
agent-auth-start | write | Start the Agent Device-Code Authorization flow. Returns a device_code and verification_uri. Direct the user to open the verification_uri in their browser to approve access. Then poll agent-auth-token every 5 seconds until approved or denied. |
agent-auth-token | read | Poll for the result of an Agent Device-Code Authorization flow. Call every 5 seconds after agent-auth-start. Returns { access_token, token_type, expires_in } on approval, { error: |
analyze-tech-stack | read | Analyze the technology stack of a domain |
ask-api | read | Ask API lookup for natural language website list queries. OpenAI requests are served as preview results and do not commit full reports. |
check-domain-trust | read | Check the trust score of a domain |
discover-technologies-by-concept | read | Search for technologies matching a concept, then explore adoption |
domain-lookup | read | Returns the live web technologies used on the root domain name, including v25 confidence scores. |
find-related-websites | read | Find websites related to a domain |
get-technology-recommendations | read | Get technology recommendations for a domain |
payment-balance | read | Check your BuiltWith Agent Payment API credit balance. Returns credits_total, credits_used, and credits_available. |
payment-config | read | Retrieve your BuiltWith Agent Payment API configuration. Returns max_per_purchase, max_monthly, monthly_purchased, monthly_remaining, and cost_per_2000_credits_usd. |
payment-purchase | read | Purchase BuiltWith API credits using your saved Stripe payment method. Minimum 2,000 credits per purchase. Returns success, credits_purchased, cost_usd, payment_id, and credits_available. |
research-company | read | Research a company |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (4 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (5)
console.error(`BuiltWith MCP (HTTP) listening on http://127.0.0.1:${port}/mcp`);http://127.0.0.1:8787/mcp
http://127.0.0.1:8787/health
@modelcontextprotocol/sdk, express, zod
* `agent-auth-token` – Poll for authorization result and retrieve access token (no API key required)
Gates applied: no_behavioural_pass.
a0fb0c20668ffull audit observations/trust-audit/mcp-server/builtwith__builtwith-1.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-08 | a0fb0c20668f | SAFE | B | 89 | first audit |
Questions
What is the BuiltWith MCP server?
BuiltWith MCP Server
What tools does BuiltWith expose?
13 in total: 12 read-only, 1 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is BuiltWith safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does BuiltWith need?
It reads BUILTWITH_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does BuiltWith run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @builtwith/mcp-server at 1.12.0.
How current is this page?
The grade is for one exact copy of the source (a0fb0c20668f), read on 2026-10-08. The repository is watched and re-audited when it changes.