What it can read

Backend

Read from package.json, requirements.txt, pyproject.toml, go.mod, the Gemfile, composer.json and .csproj.

• Express
• Next.js
• NestJS
• Fastify
• Hono
• Elysia
• Koa
• AdonisJS
• SvelteKit
• Remix
• Nuxt
• Nitro
• Astro
• Django
• Flask
• FastAPI
• Litestar
• Sanic
• Tornado
• aiohttp
• Starlette
• Gin
• Echo
• Fiber
• chi
• Gorilla
• Beego
• Go
• Rails
• Sinatra
• Hanami
• Roda
• Grape
• Ruby
• Laravel
• Symfony
• Slim
• CodeIgniter
• CakePHP
• Yii
• PHP
• ASP.NET Core
• .NET

Frontend

• React
• Vite
• Vue
• Nuxt
• Svelte
• Angular
• Astro
• Solid
• Qwik
• Preact
• Remix
• htmx
• Tailwind CSS
• Electron

Mobile

Held to client-application expectations rather than to a backend's.

• Flutter
• React Native
• iOS (native)
• Android (native)

Databases

• Postgres
• MySQL
• SQLite
• SQL Server
• MongoDB
• Redis
• Firestore
• DynamoDB
• Convex

Hosted data platforms

Recorded separately from the engine underneath, so a rule written about Postgres keeps working whether it is Supabase, Neon or your own server.

• Supabase
• Firebase
• PlanetScale
• Neon
• Vercel Postgres
• Turso
• Upstash
• DynamoDB
• Convex

ORMs

• Prisma
• Drizzle
• TypeORM
• Sequelize
• Knex
• MikroORM
• Kysely
• SQLAlchemy
• Tortoise
• Peewee

Source languages

Read from the files themselves. A project in a language on this list is analysed; one in a language that is not is reported as partially read rather than scored as if the unread files were empty.

• TypeScript
• JavaScript
• Python
• PHP
• Go
• Ruby
• Java
• C#
• Rust
• Kotlin
• Swift
• Dart

And what it can be judged as

Reading the stack is half of it. The other half is what that kind of product is held to — which is the difference between a report you can act on and a list of things a server would need.

Static Site

Static or primarily frontend site with minimal backend requirements.

Internal Tool

Operational tool for internal users with moderate security and operability expectations.

Game

A game served to players, judged on whether progress survives and assets arrive.

Client application

A tool people use, without accounts to manage or subscriptions to sell.

Mobile application

An app installed on a device its author does not own, shipped through a store.

B2C App

Consumer-facing app with user accounts, privacy duties and abuse exposure.

B2B SaaS

Business SaaS with tenancy, authorization depth, privacy duties and operability expectations.

AI SaaS

AI-powered SaaS with async workloads, upload safety, cost exposure and high observability needs.

Marketplace

Two-sided product where distinct parties transact, requiring role separation, payment integrity and dispute handling.

Or let it decide: the analyzer picks the profile itself and says how sure it is, and where the evidence does not settle it, it says that instead of guessing.

Where a dependency is not enough

Most of the list above is settled by one line in a manifest. These are not, and what settles them changes what the report asks of the project.

Express

the dependency, or an import in the source

Astro

counted as a backend only when configured to serve requests

Django

manage.py, settings.py and urls.py together

Flask

the dependency, or an import in the source

FastAPI

the dependency, or an import in the source

Go

a go.mod with no framework in it — net/http is a real answer

Ruby

a Gemfile with no web framework in it

PHP

PHP sources with no framework in composer.json

ASP.NET Core

the Microsoft.NET.Sdk.Web SDK attribute

.NET

a .csproj with no web SDK

Flutter

pubspec.yaml — classified as a client application, not a backend

React Native

the react-native or expo dependency

iOS (native)

Info.plist, Package.swift, a Podfile or an .xcodeproj in the tree

Android (native)

AndroidManifest.xml, or build.gradle in either dialect

Supabase

recorded alongside the engine it is — Postgres

Firebase

Firestore

PlanetScale

MySQL

Neon

Postgres

Vercel Postgres

Postgres

Turso

SQLite

Upstash

Redis