Price: free. Which tools a company runs, from its DNS records, certificate-transparency logs, home page and its own job posts. Each finding names the trace it came from and the earliest dated evidence (firstSeen). Use when: "what stack does acme.com use", "do they use Okta / Salesforce / OpenAI", "what tools does this company run", "did they just start cold outbound" (outbound: true). Skip when: the user wants people, emails or phone numbers, or wants the company contacted; this tool only reads public records. reached lists each source and whether it was read; a source that was not reached is unknown, not "none". Job findings include a reading: in_use, considering, migration or named. Only in_use supports usage; considering, migration and named are mentions, not proof the company runs the tool. Quoted page text is normalized; a quote that reads like an instruction keeps its text and is flagged in Flags with the attack family.