Vibeleaderboard
← Back to Tools
Index / tool

witr

github.com/pranshuparmar/witr
Visit github.com
Category
Developer Tools
Rank
No. 761Tools index
Pricing
Open Source
Type
TOOL
Use case
Deployment & Operations
Interfaces
CLI
Builder
pranshuparmar
GitHub
22.5k stars
Latest release
v0.3.3
Date

About

A CLI and TUI tool that traces any running process, open port, container, or file back through the full chain of supervisors, shells, services, and containers responsible for starting it, replacing manual correlation across ps, lsof, ss, and systemctl.

What it does

Give witr a name, process identifier, port, file, or container. It resolves the relevant process and explains its origin through readable detail, compact ancestry, tree output, warnings, environment data, JSON, or an interactive terminal dashboard.

Why it's ranked here

Its narrow question is genuinely useful during incident response and machine cleanup. Multiple target types, ordered batch queries, structured output, distinct exit codes, and automatic color suppression make it practical both at a terminal and inside scripts.

What's good

The output modes fit different jobs: concise ancestry for quick checks, trees for relationships, JSON for automation, warnings for suspicious details, and verbose output for deeper inspection. It handles multiple mixed targets and preserves their command-line order.

Tradeoffs

Process inspection can fail when operating-system permissions block access, and the tool reports that separately. Community packages may trail GitHub releases. Its scope is current process causality, not continuous monitoring, historical analysis, alerting, or service control.

How to use it well

Use it when debugging an unexpected listener, daemon, container workload, locked file, or process you did not start directly. Begin interactively, narrow the target, then switch to short or JSON output for repeatable checks. Keep monitoring and remediation tools beside it.

Technical notes+

main.go gates builds to Linux, Darwin, FreeBSD, and Windows, then delegates to the Cobra application in internal/app/app.go. That file parses repeatable mixed targets, preserves argument order, defaults to the TUI when no target is supplied, aggregates JSON results, and defines distinct exit codes for warnings, missing targets, permissions, invalid input, and internal failures. internal/output/json.go provides full and filtered JSON shapes, while internal/app/color.go disables ANSI color for pipes, redirects, explicit opt-out, or NO_COLOR. internal/launchd/plist.go uses launchctl and plutil to recover macOS service labels, property-list metadata, and triggers. The Makefile builds with CGO disabled and exposes test, race-test, formatting, vet, and documentation targets.

Observed

Primary language
Go, using module github.com/pranshuparmar/witr and Go 1.25.
Interfaces
Command-line interface, interactive terminal UI, human-readable output, and machine-readable JSON.
Platform support
Linux, macOS, FreeBSD, and Windows.
Distribution
Single static binary, install scripts, native Linux packages, and numerous package-manager channels including Homebrew, Conda, Winget, npm, MacPorts, Chocolatey, Scoop, AUR, and FreeBSD Ports.
CLI framework
Cobra provides command parsing and shell completion support.
Verification surface
The Makefile defines regular tests, race tests, formatting checks, and go vet; supplied repository text also includes application tests.

Read from README.md, go.mod, Makefile, main.go, internal/app/app.go, internal/app/color.go, internal/output/json.go, internal/output/tree.go, internal/app/app_test.go, internal/app/vt_other.go, internal/output/short.go, internal/proc/command.go, internal/app/misc_test.go, internal/launchd/plist.go, internal/output/colors.go.

What it can do

  • Trace a running process back through its chain of supervisors, shells, and services

    Process ID or name → Causal chain of responsible processes

  • Trace an open network port back to the process and services that started it

    Port number → Causal chain showing origin of the port

  • Trace a running container back to its responsible supervisor or service chain

    Container identifier → Causal chain of processes/services

  • Trace a file back to the process chain responsible for its creation or current state

    File path → Causal chain of responsible processes

Tags

cliprocess-managementdebuggingdevopssysadmintuitroubleshootingobservability

Tech Stack

Go

Media

witr

Comments (0)

No comments yet

Editorially curated, with community endorsements as a secondary signal. Corrections welcome.