witr

name	witr
description	Use this skill when the user needs to understand why a process, service, or port is running — tracing ancestry, supervisors, containers, and service managers.

witr — Why Is This Running?

CLI tool that answers "Why is this running?" by tracing process ancestry chains, supervisor relationships (systemd, launchd, Docker, PM2, tmux, SSH), containers, and service managers.

Installation

brew install witr

Commands

• witr process explain <name> — Explain why a process is running
• witr process explain systemd-journald — Explain a specific process
• witr _ _ --exact <name> — Exact name match (passthrough)
• witr _ _ --pid <n> — Explain by PID
• witr _ _ --port <n> — Explain what's on a port
• witr _ _ --json <name> — JSON output
• witr self version — Print version

Usage Examples

• "Why is nginx running on this server?"
• "What process is using port 3000?"
• "Show me the ancestry chain for PID 1234"
• "What started this postgres process?"
• "Check if there's a process listening on port 8080"

Key Features

• Explains why a process exists, not just that it exists
• Traces: systemd, launchd, Docker, Podman, PM2, cron, tmux, SSH, and more
• Detects containers, git repos, working directory, environment variables
• Detects warnings: root process, public bindings, high memory, deleted binaries
• Cross-platform: Linux, macOS, Windows, FreeBSD
• JSON output for automation