MurmStack — Tech Stack & Third-Party Detector

See what any website is built with — and exactly which companies it contacts before you can consent. Free, private, one click.

Every tech detector tells you what a site is built with. MurmStack tells you who it talks to. Click the icon on any website and you get one number, big enough to read from across a desk: how many separate companies that page contacted. On a typical online store it is over twenty. On a well-built marketing site it is one. The first two seconds, drawn The number on its own is a headline. The chart under it is the argument. Every company is plotted at the exact millisecond it was first contacted, on a fixed two-second axis. Reading it takes no training — a staircase climbing from the left means things started early, a flat stretch means nothing happened yet, and a vertical jump means a lot of companies arrived at once. That jump is the most useful thing in the report. When eight companies land inside four milliseconds, that is one tag manager firing once, not eight separate decisions somebody made. MurmStack says so in words, because the difference matters to whoever has to fix it. What you get • How many companies the page contacted — merged properly, so a company reached through six domains counts once, not six times, and one click shows you all six. • How many of them arrived before a cookie banner could realistically be read and answered, with the exact millisecond of the first contact. • Which companies are in the business of tracking people, named and ranked, stated in words rather than by colour alone. • What the site is built with — framework, platform, payments, analytics — each line showing the global or asset that proved it, set as code because it is code. • Every row carries when that company arrived, so reading down the list is watching the page load. Light and dark, both drawn properly. Measured, not guessed Everything comes from your own browser's performance timeline and the page's own markup. When something cannot be measured, MurmStack says so instead of estimating it — and says it at the same size as the findings, because a deliberate refusal is a result too: • No download total. Browsers hide the transfer size of most cross-origin requests. Coverage measured 20% on one page and 6% on a reload of the same page. A total built on that would understate reality several times over while looking authoritative. Other tools publish one anyway. • No per-company blocking time. The browser exposes page-wide blocking only, never per-origin, so it is never divided up and pinned on one company. • No invented brand names. A company we do not recognise is shown as its domain, never as a guess. • No counting a site as its own third party. Large publishers serve their assets from a second domain they also own, which naive tools report as an outside company. Those are excluded, and the exclusion is stated rather than done quietly. What it looks like on real pages Seven pages measured on 26 July 2026, same extension, same method: A personal blog 1 company A developer platform 2 companies A SaaS marketing site 5 companies A national news site 9 companies A large apparel store 9 companies A mid-size online shop 30 companies, 22 of them before consent was possible The median was five. The distance between one and thirty is the whole point: a heavy page is a choice, not the cost of doing business. When a page is clean, it says so properly A page that contacts nothing tracking you gets its own screen, in a colour that appears nowhere else in the extension, and a short report that explains why it is short. There is no empty section with a zero in it — if there was nothing to put in a section, the section says that instead of appearing hollow. The best result this tool can report should not look like an error, so it does not. About the consent timing MurmStack reports when each third party was contacted and whether a consent tool was present. It does not tell you whether that is lawful, and it never uses words like "violation". Four things can make early firing correct, and all four are one tap away inside the report: some of these companies are the site's own infrastructure and cannot be removed without breaking the page; a request is not proof that data was collected, since your browser or another extension may have blocked it; a consent tool that loads after the two-second window would be missed; and counts are per company rather than per request, which is a judgement, so every merge shows the domains it covers. You get the timestamps. The conclusion is yours. Permissions Two: activeTab and scripting. No host permissions at all, which means MurmStack cannot run anywhere until you click its icon on that page. There is no account, no server and no analytics. Nothing about the sites you visit leaves your machine, because there is nowhere for it to go. Even the typefaces are bundled inside the extension rather than fetched — a privacy tool that phones home for a font is arguing against itself. The company list is a plain JSON file shipped in the package: 317 companies, 106 of them marked as tracking, alongside 137 platform fingerprints. The whole extension is 72 KB. Free, and staying free. No paid tier, no upsell. Part of MurmTools — murmtools.com