Keyless, Zero-Setup Enrichment
What is keyless domain enrichment?
Keyless domain enrichment turns a bare domain into a structured dossier with no API key required, because the service owns the crawl instead of borrowing your credentials. You call one endpoint, it fetches and fingerprints the domain live, and returns tech, infrastructure, firmographics, AI stack, and security together. Bassethound does this over MCP, so any agent enriches a domain in a single keyless call.
Best move: call an endpoint that owns its own crawl, so enrichment asks nothing from you but the domain name.
Why it works: the answer comes from a live fetch the service runs, not from a licensed corpus it meters. Own the crawl and there is no gated asset, so there is no key.
Key takeaways
- Keyless enrichment means the caller supplies no API key; the service authenticates to nothing because it crawls the target directly.
- Bring-your-own-key enrichment exists because the vendor resells a licensed corpus or a third-party API it has to meter. Owning the crawl removes both.
- A call needs no key of your own, so an agent can enrich a domain the moment it has the name.
- Keyless does not mean unauthenticated for everything; deeper profiles and higher volume move behind OAuth, but the base enrichment stays open.
- Bassethound returns tech, infrastructure, firmographics, AI stack, and security in one keyless call, correlated instead of scattered across five separate lookups.
Why does most enrichment need an API key?
Most enrichment vendors resell data they fetched long before you called. Clearbit, Apollo, and ZoomInfo maintain a licensed contact corpus. BuiltWith and Wappalyzer maintain a tech-detection index built from a wide historical crawl. WhoisXML, DomainTools, and Censys resell registration, DNS, and scan history. The value sits in a corpus the vendor built and pays to keep current, and the API key meters your access to it. So the key is a billing boundary around an asset you rent, not a technical requirement of the lookup. That accounts for the signup form and the per-lookup quota, and for why an agent stalls until a human provisions a secret. This shape fits a business whose moat is the corpus. It fits badly when an agent wants one domain right now and will never touch a bulk export. For that job, provisioning a key is pure overhead, and keyless deletes it first.
What does owning the crawl change?
Fetch the target domain at request time and the economics flip. With no licensed corpus to protect, there is no meter for a key to guard. Your marginal cost is one live HTTP fetch plus an optional JavaScript render, not a per-record royalty owed to a data supplier. The base tier can stay free and cap abuse with a daily limit. Owning the crawl also changes what the numbers mean: they read the domain as it exists the instant you call, not as a vendor’s last recrawl saw it, which might be weeks stale. You pay for that freshness with reach. You get one domain per call, fingerprinted now, instead of a prebuilt index you query in bulk. History still favors a corpus, though a deep profile narrows the gap with Wayback first-seen dates. Contact breadth favors a corpus outright. For a live read of what a domain runs today, including its AI stack, the fresh fetch wins, and it hands you the answer without a key.
Is keyless the same as free or unlimited?
No. Keyless names one thing you skip: credentials. It says nothing about price or volume. The free tier has a daily cap so one caller cannot saturate the shared crawl, and heavier use moves behind OAuth on a paid tier for deeper profiles and higher throughput. That gap shows up at the very first call. A bring-your-own-key tool makes you provision and rotate a secret before anything runs. A keyless tool starts from the domain name and one sign-in, with no secret for you to source. Activation cost drops to zero. Limits do not vanish, and pretending they did would be dishonest. It stays open by default and meters only where volume or depth make metering fair. For most single-domain questions an agent asks, the free path answers them.
What can a keyless crawl miss?
Owning the crawl trades corpus depth for freshness, and a live fetch carries blind spots worth naming. A static crawl reads server-rendered HTML and response headers. Components that boot only in the browser need a JavaScript render pass, which Bassethound runs when the signals warrant it. Even then, anything purely server-side leaves no client trace: a model call fired from the backend, a proxied third-party API, a widget gated behind login. None of that reaches the markup or the network requests a crawler can see, so it stays dark. The dossier flags these gaps instead of guessing past them, which is what keeps the AI-readiness verdict honest. So keyless enrichment runs fresher than a corpus and thinner on history. A corpus holds years of prior crawls; a live fetch holds now. A deep profile pulls Wayback first-seen dates to recover some of that past, though not all of it. Read the output for what it is: what a domain exposes today, with the unreachable parts labeled, not a full archaeological record.
How does keyless enrichment work over MCP?
Bassethound runs as a remote MCP server at mcp.bassethound.ai/mcp. Any host that speaks the Model Context Protocol (Claude, Cursor, ChatGPT) connects to the endpoint and calls one tool, sniff_domain(domain, profile). You paste no key, install no SDK, and run no crawler of your own. The server fetches the target, fingerprints five layers (tech stack, infrastructure, firmographics, AI-readiness, security), correlates them, and returns one dossier. Every call is stateless and read-only: self-contained, so nothing carries from one call into the next and there is no session to track. The distance between “I have a domain” and “I have a dossier” shrinks to a single request with no setup in between. An agent that finds a domain mid-task enriches it in the same turn, then reads the AI stack against the firmographics without wiring up five keyed services by hand. Remote delivery, the keyless base, and the fused dossier all fall out of one design decision.
Bassethound perspective
Bring-your-own-key is a tell. It marks a tool as a thin wrapper over a corpus someone else licenses, with the key passing that meter along to you. For agents, that is backwards. No agent should provision a secret just to look at a domain. Keyless is not pricing spin. It follows from owning the crawl: when the data comes from a fetch we run at request time, there is nothing to authenticate against and nothing to bill per record until you ask for real depth. Competitors will argue that a corpus beats a live crawl on history. On raw history, they are right, which is why the deep profile leans on Wayback first-seen. On freshness, on activation cost, and on the AI stack that no corpus indexes well, the live fetch wins. The crawl alone is not the moat. Fusing five correlated layers into one keyless call is. Five separate keyed MCPs cannot hand you that correlation cheaply, and making an agent juggle five keys to rebuild it by hand is the problem we deleted.
Sources
- Model Context Protocol documentation: https://modelcontextprotocol.io
- MDN, HTTP headers: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers
- RFC 6749, The OAuth 2.0 Authorization Framework: https://datatracker.ietf.org/doc/html/rfc6749
Frequently asked questions
Do I need an API key to enrich a domain with Bassethound?
No. The base tier is keyless. You call sniff_domain with a domain and get a dossier back. Only higher depth and volume move behind OAuth.
Why can Bassethound skip the API key when other enrichment tools cannot?
Because it owns the crawl. It fetches the target at request time instead of reselling a licensed corpus, so there is no metered asset that a key has to gate.
Is keyless enrichment rate-limited?
Yes. The free tier has a daily limit so one caller cannot saturate the crawl.
Does keyless mean my data is stored?
Your results are stored against your account. Each call is self-contained, so nothing carries from one call into the next.
What can keyless enrichment not see?
Anything with no client-side trace: purely server-side model calls, proxied APIs, components behind auth. A static crawl plus optional JS render reads what the page exposes, and the dossier reports the gaps.