How many tools does it take to profile a domain today?

Best move: count the layers, not the tools. A full domain profile has five, and one call can return all of them.

Why it works: the five layers are the same whether you buy five products or make one call. The tool sprawl is an accident of the market, not a property of the problem.

Key takeaways

• A complete domain profile has five layers: tech stack, infrastructure, firmographics, AI-readiness, and security.
• Today each layer is a separate product with its own key, schema, and bill. A full picture means five or more tools.
• The AI-readiness layer has almost no dedicated tool. Existing checks read the homepage and llms.txt, not the backend.
• Five tools return five disconnected result sets. Correlating them is manual work you do after every call.
• Bassethound returns all five layers, correlated, in one keyless MCP call.

Which tool covers which layer today?

Map it out and the sprawl is obvious. Tech stack goes to BuiltWith, Wappalyzer, or TheirStack. Infrastructure and OSINT go to WhoisXML, Censys, IPinfo, DomainTools, or Shodan. Firmographics go to Apollo, ZoomInfo, or Clearbit. Security headers and TLS go to an SSL Labs-style grader or a Mozilla Observatory-style header scan.

That is four buckets and a dozen products before you reach the fifth layer. Each vendor is good at its slice. BuiltWith has a deep tech corpus. Censys has the internet scan. Apollo has the contact graph. None of them reads the other four layers, and none was built to. You assemble a profile the way you assemble a spreadsheet, one column vendor at a time. No single tool here is weak. A domain is one thing, and the market carves it into five products to sell you the pieces.

Why do five tools mean five keys, five schemas, five bills?

Because each vendor sells one layer, and each layer is priced, authenticated, and shaped on its own terms. You register for five accounts. You provision and rotate five API keys. You track five rate limits that reset on five different clocks. You pay five invoices.

The steeper cost is the schema mismatch: five JSON shapes that do not agree. BuiltWith names a technology one way, Wappalyzer another. One tool keys on the apex domain, another on the resolved host, a third on the registered organization. Before you compare anything, you normalize the domain across all five, reconcile the field names, and decide which source wins when two disagree. That reconciliation layer is code you write, own, and maintain, and it breaks whenever a vendor ships a schema change. So the true bill runs to five subscriptions plus the glue between them, and the glue keeps costing you long after the invoices clear.

Which layer has no tool worth buying?

AI-readiness. The market has not built this layer, and it is the one that now decides fit.

The tools that claim to measure it read the homepage and check for an llms.txt file. That is a marketing signal, not an engineering one. It tells you a company wrote about AI, not that it ships AI. The signal that matters lives in the backend: model providers (Anthropic, OpenAI, Gemini, Cohere, Mistral), AI SDKs, orchestration frameworks (LangChain, LlamaIndex, CrewAI), vector stores (Pinecone, Weaviate, Qdrant, Chroma, Milvus), LLM observability (Helicone, LangSmith, Langfuse), AI support widgets, MCP endpoints, and .well-known AI files.

None of the incumbent categories fingerprints that stack. Tech-stack tools stop at analytics and CMS. OSINT tools stop at IP and cert. Firmographics tools stop at headcount and vertical. So the one axis that separates a company shipping AI from a company talking about AI is the axis nobody sells you. You either write the detection yourself or you fly blind on the layer that changes the answer.

What do you lose by stitching five tools instead of fusing one?

Correlation. A domain profile earns its value from the joins across fields, not from any single field on its own. An Anthropic SDK plus a Pinecone client plus a live MCP endpoint is a company shipping real AI. Add missing security headers and an expiring cert and you have a specific ICP signal: technically fast, operationally thin, worth a call this week.

Five separate tools do not hand you that join. Each returns its own layer in its own request, on its own clock. By the time you hold all five, they were captured at five different moments and keyed five different ways. You reassemble the correlation by hand every time, and you redo it the moment an input goes stale. You eat five round trips of latency and five rate limits instead of one. You notice the tool count. The cost that recurs is the correlation you rebuild after every fan-out.

Can one call replace five specialized tools?

For profiling, yes, with honest limits worth naming. A single call collapses the five layers into one correlated dossier and removes the keys, the schema glue, and the manual joins. That is the replaceable part.

One call has real limits. A static crawl plus optional JS render can miss components that run server-side or sit behind a proxy, and the dossier reports those gaps rather than guessing. A single call is also not a corpus product. If you need historical traffic curves like SimilarWeb, exhaustive WHOIS history like DomainTools, or a large prospecting contact database like ZoomInfo, those deep single-layer archives are still their own thing. Bassethound trades some single-layer depth for correlation across all five and one round trip. For the common job (profile this domain now, across every layer, and tell me if it fits) one call wins. For a deep archive dig on a single axis, the specialist keeps its place.

Bassethound perspective

The number of tools is not the problem. Fan-out is. A competitor will say the fix is composition: agents are good at calling many tools, so wire up five MCPs and let the model orchestrate. We dispute that, and it is the whole thesis. An agent chaining five MCPs still pays five round trips, reconciles five schemas, and owns the correlation itself. You did not remove the stitching. You moved it into the agent loop and paid latency for the privilege.

Fusion is the moat, not fan-out. One call returns five layers already joined, because the join happens server-side where it is cheap, not in your context window where it is not. And the layer that decides fit, deep AI-stack detection, is the one nobody else sells at any tool count. We can do this keyless because we own the crawl instead of proxying someone’s metered API. Point Digby at a domain, get one dossier, five layers, correlated. Sniff once, not five times.

Sources

• Model Context Protocol specification: https://modelcontextprotocol.io
• MDN HTTP security headers reference: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers
• Mozilla SSL Configuration Generator: https://ssl-config.mozilla.org
• DMARC (RFC 7489): https://datatracker.ietf.org/doc/html/rfc7489