See which companies a website contacts — and when
Every tech detector tells you what a site is built with. MurmStack tells you who it talks to, how many of them arrived before a cookie banner could ask you anything, and shows the evidence for every line.
Measured, not modelled. Everything on screen comes from your own browser's performance timeline and the page's own markup. Where something cannot be measured, MurmStack says so instead of estimating it.
What it reports
- How many separate companies the page contacted — merged properly, so Google's six domains count as one company, not six.
- How many arrived before you could consent, with a timeline of the first two seconds and the exact millisecond of first contact.
- What the site is built with — framework, CMS, ecommerce platform, analytics, payments — each line beside the global or asset that proved it.
- Which of those companies track people, marked plainly.
- A report card you can save as a PNG and send to someone.
What a real page looks like
Seven pages measured on 26 July 2026, same extension, same method:
| Page | Companies contacted | Before consent was possible | First contact |
|---|---|---|---|
| overreacted.io | 1 | 1 | 144 ms |
| vercel.com | 2 | 2 | 287 ms |
| notion.com | 5 | 5 | 1160 ms |
| bbc.com | 9 | 9 | 100 ms |
| gymshark.com | 9 | 9 | 913 ms |
| A Shopify store | 30 | 22 | 616 ms |
The median was five. The spread between one and thirty is the point: heavy pages are a choice, not a cost of doing business.
What it refuses to do
- It does not show a download total. Browsers hide the transfer size of most cross-origin requests; measured coverage was 20% on one page and 6% on a reload of the same page. A total built on that would understate reality while looking authoritative.
- It does not attribute blocking time to a company. The browser does not expose which script caused a long task, so blocking is reported page-wide and labelled as such.
- It does not name a company it cannot identify. An unrecognised domain is shown as its domain, never as a guessed brand.
- It does not tell you whether anything is lawful. Consent Mode, strictly-necessary cookies and your own stored consent from a previous visit can all make early firing correct. You get timestamps; the conclusion is yours.
Permissions
Two: activeTab and scripting. No host permissions at all,
which means MurmStack cannot run anywhere until you click its icon on that page. No account,
no server, no analytics — nothing about the sites you visit leaves your machine, because there
is nowhere for it to go.
Compared with the alternatives
vs Wappalyzer
Wappalyzer identifies technologies, free and without an account. MurmStack measures contact and timing instead of listing tools. Full comparison.
vs BuiltWith
BuiltWith is a lookup and lead-list product with a serious price above the free single lookup. MurmStack is a free browser measurement. Full comparison.
Questions
How many third-party companies does a typical website contact?
It varies enormously. Across seven pages measured on 26 July 2026 the range was 1 to 30 and the median was 5. The spread, not the average, is the useful figure.
How can I see which trackers load before I accept cookies?
Click MurmStack and read the timeline. It records the millisecond each company was first contacted and how many arrived inside the first two seconds — before a banner could realistically be read and answered. It reports timing only and draws no legal conclusion.
Is MurmStack free?
Yes, with no paid tier, no account and no server.
What is the difference between MurmStack and Wappalyzer or BuiltWith?
Those report an inventory of technologies. MurmStack measures behaviour — how many separate companies the page actually contacted, and when.
Does MurmStack send my browsing data anywhere?
No. Everything is computed in the browser, and there is no backend to send anything to.