The Five-Layer Dossier
What are the five layers of domain intelligence?
Domain intelligence has five layers: tech stack, infrastructure, firmographics, AI-readiness, and security. Read alone each layer is commoditized. Bassethound returns all five correlated in one keyless call, so the layers reinforce each other instead of sitting in five separate tools.
Best move: treat a domain as five correlated layers read in one pass, not five separate lookups.
Why it works: each layer answers a different question, and a lead becomes a decision only when the answers line up. Correlation is the signal, not any single detection.
Key takeaways
- The five layers are tech stack, infrastructure, firmographics, AI-readiness, and security.
- Read alone, tech stack and firmographics are commoditized (BuiltWith, Apollo). Read together, from one crawl, the layers correlate.
- The AI-readiness layer is the differentiator: deep backend fingerprinting, not a homepage llms.txt check.
- Bassethound returns all five in one keyless call and fuses them into primary_stack, ai_readiness, security_grade, and an icp_signal of hot, warm, or cold.
- A static crawl plus optional JS render can miss server-side or proxied components, and the dossier reports those gaps.
What does each of the five layers cover?
Layer one is the tech stack: frameworks, CMS, analytics, widgets, payments, ecommerce. Every detection carries a category, version, confidence, how_detected, and evidence, so you can audit the call. This is the BuiltWith-style layer, cheap to mirror and not the headline.
Layer two is infrastructure: IP, ASN, hosting org, CDN, nameservers, MX records, email provider, DNS TXT vendors, the email-auth booleans (SPF, DKIM, DMARC), and the TLS certificate (issuer, SANs, expiry, days_remaining).
Layer three is firmographics: company name, vertical, description, contacts, social profiles, and any structured data the site publishes.
Layer four is AI-readiness: model providers, AI SDKs, orchestration frameworks, vector stores, LLM observability, AI widgets, llms.txt, MCP endpoints, and .well-known AI files. It resolves to a score out of six and a verdict of shipping, experimenting, or none.
Layer five is security: a header grade from A to F (HSTS, CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy) plus a TLS grade.
The summary fuses all five into primary_stack, ai_readiness, security_grade, and an icp_signal.
Why return five layers in one call instead of five tools?
Because the value is correlation, and correlation dies when the layers live in separate tools. An agent that queries BuiltWith, then Censys, then Apollo, then some AI-readiness checker gets four answers on four clocks against four crawls. Nothing lines up. You cannot cheaply ask whether the company shipping an Anthropic backend also runs a failing security grade and a real firmographic footprint when each fact came from a different vendor at a different moment.
Fusion is the moat. One call, one crawl, five layers that reference the same observation. The infrastructure layer’s TLS expiry and the security layer’s TLS grade come from the same certificate read. The AI-readiness verdict and the tech-stack detections share evidence. The agent gets a dossier, not a pile of receipts.
Fan-out is the thing to avoid. Five MCPs mean five round trips, five auth handshakes, five rate limits, and no correlation between them. One Bassethound call is self-contained, keyless, and stateless: every request stands alone, and the server carries nothing from one call to the next.
Which layer is the differentiator, and why?
AI-readiness. The other four are strong but contested. Tech stack is BuiltWith and Wappalyzer territory. Infrastructure is Censys, Shodan, IPinfo, DomainTools. Firmographics is Apollo, ZoomInfo, Clearbit. Security headers are a known checklist. These are commodity axes with deep incumbents.
AI-readiness is the unclaimed one. Everyone else’s version is a homepage scan plus an llms.txt check, which rewards marketing over engineering. Bassethound fingerprints the backend: model providers (Anthropic, OpenAI, Gemini, Cohere, Mistral), AI SDKs, orchestration (LangChain, LlamaIndex, Haystack, CrewAI), vector stores (Pinecone, Weaviate, Qdrant, Chroma, Milvus), LLM observability (Helicone, LangSmith, Langfuse), AI widgets, MCP endpoints, and .well-known AI files. A detected vector store or a live MCP endpoint is expensive and pointless to fake, so it tells you the company ships AI rather than talks about it. That is the axis a competitor would dispute, and the one worth owning.
How do the profiles change what the five layers return?
Three profiles. Fast is deterministic, keyless, and returns in one to three seconds: infrastructure, tech stack, and security signals from a single pass, no external enrichment. Standard is the default and adds the AI stack and firmographics on top of fast. Deep adds follow-on probes, the full security grade, and Wayback first-seen history, so you can see when a component appeared.
The layers keep the same shape at every depth. What changes is how far the crawl reaches and how many follow-on requests it spends. Fast answers “what is this domain running right now” cheaply. Deep answers “what is it running, how is it secured, and when did the AI stack show up.” Pick the profile by the question, not by habit. The free tier is rate-limited with no bring-your-own-key; the paid tier opens higher depth and volume over OAuth.
What can the five layers miss?
A static crawl sees what the server sends. Optional JS rendering extends that to client-initialized code, but a fully server-side or proxied component leaves no client trail, so it can hide from both. A model call that runs entirely in a backend the crawler never touches will not surface in the AI-readiness layer. A CDN or reverse proxy can mask the origin’s real infrastructure. Firmographics depend on what the site publishes, so a sparse site yields sparse structured data.
The honest move is to report the gap, not paper over it. Every detection carries how_detected and evidence, so a low-confidence call reads as low confidence. The dossier states what it reached and what it could not. Treat a null as “not observed,” not “not present.” A quiet AI-readiness layer on a heavily proxied site is a coverage limit, not a verdict.
Bassethound perspective
The industry sells single layers and calls them intelligence. BuiltWith sells the tech stack. Censys sells the infrastructure. Apollo sells the firmographics. Each is deep, each is real, and each hands you one slice with no way to line it up against the others. That is the bet we dispute: that a domain is best understood one axis at a time. It is not. A domain is a correlated object, and the interesting questions live in the joins. Does the company running a modern AI backend also run a failing security grade? Does the firmographic vertical match the stack you would expect? You cannot ask those questions across five vendors on five clocks. You ask them inside one call that read one crawl. That is why we fused the layers instead of shipping five tools, and why the AI-readiness layer goes to the backend instead of the homepage. Marketing pages talk. A loaded Pinecone client and a live MCP endpoint do not. Bassethound reads the stack, not the story, and returns the whole object at once so the correlation is done before the agent asks.
Sources
- Model Context Protocol specification: https://modelcontextprotocol.io/specification
- llms.txt proposal: https://llmstxt.org
- MDN Content-Security-Policy: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
- Mozilla SSL Configuration Generator: https://ssl-config.mozilla.org
- IETF RFC 7489 (DMARC): https://datatracker.ietf.org/doc/html/rfc7489
Frequently asked questions
What are the five layers of domain intelligence?
Tech stack, infrastructure, firmographics, AI-readiness, and security. Bassethound returns all five in a single call and fuses them into a summary with primary_stack, an ai_readiness score, a security_grade, and an ICP signal.
Why five layers instead of one lookup?
A single layer is commoditized and answers one question. The value is correlation across layers, which you only get when one crawl produces all five at the same moment.
Which layer is the differentiator?
AI-readiness. It fingerprints the backend (model providers, SDKs, orchestration, vector stores, MCP endpoints) instead of scanning the homepage, which is the shallow check most tools stop at.
Do all five layers return on every call?
Depth depends on the profile. Fast returns infrastructure, tech stack, and security signals; standard adds the AI stack and firmographics; deep adds follow-on probes, the security grade, and Wayback first-seen history.
What can the five layers miss?
A static crawl plus optional JS render can miss fully server-side or proxied components, and a masked origin can hide real infrastructure. The dossier reports those gaps, so a null reads as not observed, not not present.