What Crawle checks
Technology scans reuse normal crawl evidence instead of running intrusive security probes.
Response headers, public HTML markers, meta generator tags, and script/style URLs.
Framework and platform hints such as Next.js, Shopify, WordPress, Cloudflare, Vercel, nginx, Apache, and PHP.
Exposed client-library versions where public assets reveal them.
Security-header posture such as HSTS and Content-Security-Policy on sampled HTTPS responses.
Optional cached enrichment from OSV.dev, CISA KEV, FIRST EPSS, and endoflife.date when enabled.
Risk language
Findings are presented as technology risk signals, not as a replacement for a dedicated security scanner.
High-severity exposed-version findings require deterministic public evidence.
Unknown versions are shown as context, not as version-specific vulnerability claims.
AI-assisted review, when enabled later, must not be the sole source for critical findings.
Evidence is bounded and sensitive headers such as cookies and authorization values are redacted.
Scan cadence
Automatic scans run monthly by default and can be adjusted per site.
Run an on-demand scan from the Technology tab when a team has changed frameworks or frontend bundles.
Keep automatic scans enabled for client sites where stack drift or exposed old assets matter.
Disable scans per site if the customer does not want technology posture checks.
Crawle stores the current profile and finding history so agents and reports can reference it later.
Alerts and reports
Technology risk signals use the same routing controls as the rest of Crawle.
Critical and high deterministic findings can notify in real time.
Warnings can roll into daily digests according to the workspace alert policy.
Weekly reports include stack context and top open technology findings.
CSV and JSON exports are available with finding state, severity, evidence, and advisory IDs.
Using agents
OAuth MCP tools expose the same stack and risk context to Claude, ChatGPT, Codex, Gemini, and internal agents.
Grant technology:read so agents can summarize stack context and open findings.
Grant technology:write only when agents should run scans, acknowledge findings, or update scan settings.
Ask agents to separate deterministic findings from general hardening recommendations.
Keep workspace context explicit when an account has multiple client workspaces.
Private beta note
Crawle is currently invite-only. Some features depend on workspace permissions, connected accounts, API quotas, or integration setup by the organization.