How do you do a competitive teardown of a website?

Best move: read the competitor’s live site across five correlated layers in one pass.

Why it works: you read one layer against another, and that is where the signal is. A framework list alone tells you little. That same framework calling a vector store on a hardened host for a funded fintech tells you what to do next.

Key takeaways

• A teardown is a live read of a competitor’s site across five layers. A tech-stack list is one of them.
• The layers correlate. A detected model provider plus a vector store plus an AI SDK tells you they ship, where any one signal alone would not.
• Everything a teardown reads is public and passive (DNS, TLS, response headers, loaded scripts). No login required to read them.
• AI-readiness is where teardowns diverge. Most tools stop at the homepage and llms.txt. Deep backend fingerprinting reads the running stack.
• One keyless call returns the full dossier, so an agent can tear down a list of competitors in a loop.

What does a full teardown cover that a tech-stack lookup misses?

A tech-stack lookup answers one question: which frameworks, CMS, analytics, and widgets does the page load. Useful, and commoditized. BuiltWith and Wappalyzer have done it for years. A teardown answers four more questions in the same pass. Where does the site run (IP, ASN, hosting org, CDN, nameservers, MX, email provider, and the TLS certificate with its days remaining)? Who is the company (name, vertical, contacts, social profiles, structured data)? Do they ship AI (model providers, SDKs, orchestration frameworks, vector stores, observability, MCP endpoints)? Is the site hardened (security header grade, TLS grade)? The correlation is the value. Any tool can print five lists. A React front end (tech) that calls a Pinecone endpoint (AI) on Vercel infrastructure (infra) for a Series-A fintech (firmographics) behind an A security grade is a different competitor than one running WordPress with a chat widget and no backend AI. A stack list cannot draw that line. A teardown can, because it holds all five layers against each other in one dossier.

How do you tell if a competitor ships AI or only markets it?

Read the backend, not the banner. Any site can add “AI-powered” to a headline. A site that ships AI has to load an SDK and call a provider, and those signatures survive minification. Deep AI-readiness fingerprinting looks for model providers (Anthropic, OpenAI, Gemini, Cohere, Mistral), AI SDKs (Anthropic SDK, OpenAI SDK, Vercel AI SDK), orchestration (LangChain, LlamaIndex, Haystack, CrewAI), vector stores (Pinecone, Weaviate, Qdrant, Chroma, Milvus), and observability (Helicone, LangSmith, Langfuse). It also classifies llms.txt (standard vs technical) and probes for MCP endpoints and .well-known AI files. Count the distinct signal groups a site hits, cap at six, and you get an ai_readiness score with a verdict: shipping, experimenting, or none. A competitor with a vector store, an SDK, and an observability tool is shipping. One with only an llms.txt and a homepage claim is experimenting at best. Most competitor-analysis tools stop at the homepage read. That is the shallow end, and it rewards marketing copy over engineering. The deep read is the axis nobody else claims.

How do you run a teardown across a whole competitor set at once?

Loop the call. A teardown is one tool, sniff_domain(domain, profile), and it is stateless. Every call is self-contained and nothing carries between requests, which is what makes batching cheap. Point an agent at a list of ten competitors, call the tool once per domain on the standard profile, and you get ten correlated dossiers you can diff. Because the endpoint is a remote MCP server (mcp.bassethound.ai/mcp), any agent host connects to it: Claude, Cursor, ChatGPT. The free tier is keyless and rate-limited, so you provision nothing to start. For a market map, run standard across the set to place each competitor on the AI-readiness axis, then re-run deep on the two or three that matter for the security grade and the Wayback first-seen timeline. The alternative (wiring five separate MCP servers for tech, infra, firmographics, AI, and security, then stitching their output yourself) costs you the correlation. An agent that fans out to five servers pays twice: in tokens, and in the coherent per-domain picture it can no longer assemble. One call already did it.

What can a teardown not see?

Be honest about the gaps, because a dossier that overclaims is worse than one that flags its blind spots. A teardown reads the public surface: DNS, TLS, response headers, and the code the page loads. It does not log in and it does not touch anything behind auth. Two limits matter. First, rendering. A static crawl catches server-rendered imports and inline config, but a component that only initializes in the browser needs a JS render. Bassethound renders when the signals call for it and reports what it could not reach. Second, proxying. A backend that routes a model provider through the company’s own domain, or behind a server-side proxy, leaves no client-visible trail. You see the front-end call to their own API and no further. The dossier marks these as gaps rather than guessing. So a “none” verdict on AI-readiness means no client-visible AI signals, not provably no AI. Read it as a strong lead, not a courtroom proof. The teardown tells you where to look next.

Bassethound perspective

A competitive teardown is worth running only if it changes what you do next, and a single-layer stack list rarely clears that bar. Everyone can already see a competitor runs Next.js on Vercel. That is table stakes, and it is free. The teardown that moves you correlates layers. One signal explains another, and that read is the whole product. BuiltWith and Wappalyzer own tech detection. Censys and Shodan own infra. Apollo and Clearbit own firmographics. Each goes deep in one column, and none of them tells you that the Series-B in your category just wired a vector store to an orchestration framework behind an A-grade site. That sentence is the one that changes your roadmap. Fusion is the moat, not fan-out. An agent could call five separate MCP servers and try to stitch the results, but the stitch is expensive and lossy, and the AI-readiness column stays shallow because those tools read the homepage. We built the deep AI read because it is the unclaimed axis, and because it is the one signal a competitor cannot fake. Sniff the stack, not the story. Then act on what you find.

Sources

• Model Context Protocol: https://modelcontextprotocol.io
• llms.txt standard: https://llmstxt.org
• MDN HTTP headers reference: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers
• Mozilla SSL Configuration Generator: https://ssl-config.mozilla.org