Martech stack detection for AI agents.
Infervo takes a company URL, renders the public website in a headless browser, captures runtime scripts, network beacons, cookies, consent behavior, and public DNS email infrastructure, then returns a structured report with evidence. The detection path is deterministic; the optional AI memo is a separate on-demand summary over detected vendor names only.
- CLI API
- https://infervo.app/api/cli
- MCP
- https://infervo.app/api/mcp
- OAuth metadata
- https://infervo.app/.well-known/oauth-protected-resource
- Tokens
- https://infervo.app/app/settings/tokens
- OpenAPI
- https://infervo.app/api/cli/openapi.json
whoami -> scan -> report
Mint a write-scoped personal access token in the app, keep it in an environment variable, then use the CLI API from curl, fetch, Python, or an agent shell.
export INFERVO_TOKEN="inv_pat_..."
BASE="https://infervo.app/api/cli"
# 1. Verify token and workspace.
curl -sH "Authorization: Bearer $INFERVO_TOKEN" "$BASE/whoami"
# 2. Run one synchronous scan.
SCAN_ID=$(curl -sH "Authorization: Bearer $INFERVO_TOKEN" \
-H "Content-Type: application/json" \
-d '{"url":"shopify.com"}' \
--max-time 120 \
"$BASE/scans" | jq -r '.data.id')
# 3. Fetch the evidence-backed report.
curl -sH "Authorization: Bearer $INFERVO_TOKEN" \
"$BASE/scans/$SCAN_ID" \
| jq '.data | {domain,status,totalTools,quality:.quality.key,detections}'Native tools for agent clients
The hosted MCP endpoint exposes scan_martech, scan-batch tools, history, diff, compare, memo, and watch management. Clients can connect with bearer PAT headers or the OAuth 2.1 / PKCE connector flow.
claude mcp add --transport http infervo \
https://infervo.app/api/mcp \
--header "Authorization: Bearer $INFERVO_TOKEN"Use a read token for list/fetch/compare work. Use a write token only when the agent needs to run scans, generate memos, or manage watches.
Connector status
Infervo now exposes the OAuth metadata, dynamic registration, PKCE authorization, and token endpoints needed by authenticated remote MCP clients. PAT bearer auth remains available for tools that can send custom headers.
- 01For header-capable environments, use the OpenAPI document or MCP endpoint with an Authorization bearer token.
- 02For OAuth-capable remote MCP clients, register the server URL
https://infervo.app/api/mcpand follow the consent flow. - 03Grant write scope only when the agent should create scans, batches, memos, or watches.
Signed stack-change alerts
A watch re-scans a domain every 6, 24, or 168 hours and POSTs only when the stack changes. The webhook target must be public HTTPS. Infervo signs the raw JSON body with the watch signing secret.
{
"event": "stack_changed",
"domain": "shopify.com",
"project": "competitors",
"scanId": "scan_...",
"scanUrl": "https://infervo.app/app/scans/scan_...",
"added": [{ "vendor": "Klaviyo", "category": "Email/CRM" }],
"removed": [{ "vendor": "Mailchimp", "category": "Email/CRM" }],
"previousScanAt": "2026-07-02T12:00:00.000Z",
"scannedAt": "2026-07-03T12:00:00.000Z"
}import { createHmac, timingSafeEqual } from "node:crypto";
export function verifyInfervoSignature(rawBody, header, secret) {
const sent = String(header || "").replace(/^sha256=/, "");
if (!/^[a-f0-9]{64}$/i.test(sent)) return false;
const expected = createHmac("sha256", secret).update(rawBody).digest("hex");
const a = Buffer.from(sent, "hex");
const b = Buffer.from(expected, "hex");
return a.length === b.length && timingSafeEqual(a, b);
}Only scan public sites you are authorized to assess
Infervo fetches and renders the public website you submit and reads public DNS for that domain. It does not connect to customer databases, does not ingest private files, does not attempt logins or auth bypass, refuses private and metadata targets, and runs with bounded concurrency and timeouts. To exclude a domain, email hello@infervo.app.
SSRF guard
Private, loopback, link-local, reserved, and cloud-metadata targets are blocked.
Identifies itself
DNS and static-HTML requests send an InfervoScanner user-agent / From header. The headless browser render uses a realistic UA on purpose: it must render like a browser to detect client-side tools.
Web Bot Auth
Verifiable bot identity (RFC 9421 HTTP Message Signatures / Web Bot Auth) is on our roadmap as the standard matures. We will not advertise a signing key we don't sign with: today the non-browser requests self-identify, and the primary render is an honest real-browser fetch.
Opt out
Email hello@infervo.app to exclude a domain from scanning. We honor removal requests for sites you operate.
Retention
A scan's results belong to the requesting workspace and are deleted when that scan, project, or account is deleted.
Evidence first
Each detection points at a signature, network host, cookie, script, or DNS record.
Coverage aware
Runtime-limited, static HTML, DNS-only, blocked, queued, running, and failed states are explicit.
No scan-path LLM
The optional memo sends only domain and detected vendor names to OpenRouter on demand.