which-nuxt

🔍 Point it at a URL. Get back the Nuxt and Vue versions, the Nuxt modules, the host, and any GitHub advisories that match.

[!TIP] Using an AI agent? Get the which-nuxt Skill on skilld.dev/gh/harlan-zw/which-nuxt.

Features

• 🔍 Versions from a URL: See the exact Nuxt version a site runs, and the Vue version when a bundled chunk exposes it, with no access to its code.
• 🛡️ Advisory check: Find out which GitHub security advisories affect those versions. An inferred version range gives a possible match, not a confirmed one.
• 🧩 20 Nuxt modules: Spot Nuxt UI, Nuxt Content, i18n, the Nuxt SEO modules and more. Each match says how sure it is.
• 🌐 Hosting and domain age: Learn which platform serves the site and, if you ask, how old its domain is.
• 🕷️ Built for crawlers: Already have the HTML? Scan it with no extra requests, and load only the module presets you use.

CLI

# Scan a site
npx which-nuxt https://nuxt.com

A bare hostname such as nuxt.com is scanned as https://nuxt.com.

The whichnuxt alias runs the same command.

# Print the full result as JSON
which-nuxt https://nuxt.com --json

# Skip the GitHub advisory check
which-nuxt https://nuxt.com --no-advisories

# Read the page only: no JavaScript chunks, no endpoint probes
which-nuxt https://nuxt.com --no-js --no-endpoints

# Add the domain age, and use a token for a higher GitHub rate limit
which-nuxt https://nuxt.com --age --github-token "$GITHUB_TOKEN"

Exit codes

What it requests

One scan fetches the page, up to 4 JavaScript chunks, and a set of public endpoints such as /_payload.json, /_nuxt/builds/latest.json and module debug routes. The advisory check calls the GitHub API. --age adds one RDAP lookup. Each --no-* flag turns its step off.

Every request identifies itself as which-nuxt/<version> (+https://github.com/harlan-zw/which-nuxt). Pass --user-agent to change it for the target site.

API

import { checkAdvisories, detectNuxt } from 'which-nuxt'

const detected = await detectNuxt('https://nuxt.com')
const advisories = await checkAdvisories(detected)

detectNuxt() returns, among other fields:

• packages: detected dependency versions. checkAdvisories() reads these.
• modules: Nuxt module fingerprints, each with a certainty of confirmed, inferred or possible.
• hosting.provider: the edge, CDN or platform named by the response headers.
• hosting.domainAge: registrar, creation date and age from RDAP, when you pass domainAge: true.

Every result carries a confidence score. checkAdvisories() reports an exact match for a detected version and a possible match for an inferred range.

Module presets

By default detectNuxt() runs every bundled module mapping. Pass one preset and the others never load at runtime:

import { detectNuxt } from 'which-nuxt'
import { officialNuxtModuleDetectors } from 'which-nuxt/modules/official'

const detected = await detectNuxt('https://nuxt.com', {
  moduleDetectors: officialNuxtModuleDetectors,
})

This trims runtime work, not bundle size: detectNuxt() keeps a lazy import of the default presets, so a bundler still emits every preset as a lazy chunk. For a smaller bundle, scan the HTML and JavaScript yourself with which-nuxt/scanners.

Pass moduleDetectors: false to skip module fingerprinting and keep core Nuxt detection.

Scanners

A crawler already has each page's HTML and its /_nuxt/ assets. Hand them to the scanners and skip the requests detectNuxt() would make:

import { officialNuxtModuleDetectors } from 'which-nuxt/modules/official'
import { scanHtml, scanJs } from 'which-nuxt/scanners'

const page = scanHtml(html, url, { moduleDetectors: officialNuxtModuleDetectors })
const entry = scanJs(entryChunk, { moduleDetectors: officialNuxtModuleDetectors })

Cache

Pass an unstorage instance to cache the full detection result. Install unstorage in your project first: pnpm add unstorage.

import type { DetectCacheArtifact } from 'which-nuxt'
import { createStorage } from 'unstorage'
import memoryDriver from 'unstorage/drivers/memory'
import { detectNuxt } from 'which-nuxt'

const cache = createStorage<DetectCacheArtifact>({ driver: memoryDriver() })

const first = await detectNuxt('https://nuxt.com', { cache })
const cached = await detectNuxt('https://nuxt.com', { cache })
const fresh = await detectNuxt('https://nuxt.com', { cache, cacheBust: true })

cacheMaxAge expires entries after this many milliseconds. cacheNamespace and cacheKey control the storage keys. An incomplete scan is not cached, so the next call retries the failed steps.

Supported Module Mappings

Every mapping reads public fingerprints, so a site can hide or fake any of them. The certainty on each result tells you how much weight the signal carries.

License

Licensed under the MIT license.