# witr
### Why is this running?
Trace any process, port, container, or file back to the exact chain that started it —
one command, machine-readable JSON, or an [interactive TUI](#4-interactive-mode-tui).
[](https://github.com/pranshuparmar/witr/releases/latest) [](#8-platform-support)
[](https://repology.org/project/witr/versions)

### 🎮 [**Try witr in your browser →**](https://pranshuparmar.github.io/witr/)
*Investigate a simulated Linux box — a guided tutorial and free-play sandbox, no install required.*
[**Purpose**](#1-purpose) • [**Installation**](#2-installation) • [**AI Agents**](#3-using-witr-with-ai-coding-agents) • [**TUI**](#4-interactive-mode-tui) • [**Examples**](#5-example-outputs)
[**Flags**](#6-flags--options) • [**Output Behavior**](#7-output-behavior) • [**Platforms**](#8-platform-support) • [**Sponsors**](#9-sponsors)
1. Purpose
witr exists to answer a single question:
Why is this running?
When something is running on a system, whether it is a process, a service, or something bound to a port, there is always a cause. That cause is often indirect, non-obvious, or spread across multiple layers such as supervisors, containers, services, or shells.
Existing tools (ps, top, lsof, ss, systemctl, docker ps) expose state and metadata. They show what is running, but leave the user to infer why by manually correlating outputs across tools.
witr makes that causality explicit. Ports, services, containers and files all map back to a PID, and for that PID witr answers:
- What is running?
- How did it start?
- What is keeping it running?
- What context does it belong to?
The answer comes as a single human-readable report, as JSON for scripts and AI agents, or in an interactive TUI dashboard.
witr node # why is this node process running?
witr --port 8080 # what is holding port 8080, and why?
witr --pid 1234 --tree # its ancestry and children as a tree
witr --container redis # a container, across Docker, Podman, Kubernetes and more
witr --port 8080 --json # the same answer for scripts and AI agents
witr # browse everything in the interactive TUI
📖 Curious how witr came to be? Read the story.
2. Installation
witr is distributed as a single static binary for Linux, macOS, FreeBSD, and Windows.
witr is also independently packaged and maintained across multiple operating systems and ecosystems. An up-to-date overview of packaging status is available on Repology. Please note that community packages may lag GitHub releases due to independent review and validation.
[!TIP]
If you use a package manager (Homebrew, Conda, Winget, etc.), we recommend installing via that for easier updates. Otherwise, the install script is the quickest way to get started.
2.1 Quick Install
Unix (Linux, macOS & FreeBSD)
curl -fsSL https://raw.githubusercontent.com/pranshuparmar/witr/main/install.sh | bash
Script Details
The script will:
- Detect your operating system (`linux`, `darwin` or `freebsd`)
- Detect your CPU architecture (`amd64`, `arm64` or `loong64` on Linux)
- Download the latest released binary and man page
- Install it to `/usr/local/bin/witr`
- Install the man page to `/usr/local/share/man/man1/witr.1`
To install somewhere else, such as `~/.local` (no sudo needed), set `INSTALL_PREFIX` on `bash`:
curl -fsSL https://raw.githubusercontent.com/pranshuparmar/witr/main/install.sh | INSTALL_PREFIX="$HOME/.local" bash
Windows (PowerShell)
irm https://raw.githubusercontent.com/pranshuparmar/witr/main/install.ps1 | iex
Script Details
The script will:
- Download the latest release (zip) and verify checksum.
- Extract `witr.exe` to `%LocalAppData%\witr\bin`.
- Add the bin directory to your User `PATH`.
2.2 Package Managers
APT (Debian, Ubuntu & Derivatives) 
You can install **witr** from the official Debian and Ubuntu repositories (Ubuntu 26.04+, Debian sid and later), as well as derivative distributions like Kali Linux, Devuan, and Raspbian:
sudo apt install witr
> Note: The apt-shipped version may lag the latest GitHub release. For the newest features, use the install script or another installation method.
Homebrew (macOS & Linux) 
You can install **witr** using [Homebrew](https://brew.sh/) on macOS or Linux:
brew install witr
MacPorts (macOS) 
You can install **witr** using [MacPorts](https://www.macports.org/) on macOS:
sudo port install witr
Conda (macOS, Linux & Windows) 
You can install **witr** using [conda](https://docs.conda.io/en/latest/), [mamba](https://mamba.readthedocs.io/en/latest/), or [pixi](https://pixi.prefix.dev/latest/) on macOS, Linux, and Windows:
conda install -c conda-forge witr
# alternatively using mamba
mamba install -c conda-forge witr
# alternatively using pixi
pixi global install witr
Arch Linux (AUR) 
On Arch Linux and derivatives, install from the [AUR package](https://aur.archlinux.org/packages/witr-bin):
yay -S witr-bin
# alternatively using paru
paru -S witr-bin
# or use your preferred AUR helper
Winget (Windows) 
You can install **witr** via [winget](https://learn.microsoft.com/en-us/windows/package-manager/winget/):
winget install -e --id PranshuParmar.witr
NPM (Cross-platform) 
You can install **witr** using [npm](https://www.npmjs.com/package/@pranshuparmar/witr):
npm install -g @pranshuparmar/witr
FreeBSD Ports 
You can install **witr** on FreeBSD from the [FreshPorts port](https://www.freshports.org/sysutils/witr/):
pkg install witr
# or
pkg install sysutils/witr
Or build from Ports:
cd /usr/ports/sysutils/witr/
make install clean
Chocolatey (Windows) 
You can install **witr** using [Chocolatey](https://community.chocolatey.org):
choco install witr
Scoop (Windows) 
You can install **witr** using [Scoop](https://scoop.sh):
scoop install main/witr
AOSC OS 
You can install **witr** from the [AOSC OS repository](https://packages.aosc.io/packages/witr):
oma install witr
GNU Guix 
You can install **witr** from the [GNU Guix repository](https://packages.guix.gnu.org/packages/witr/):
guix install witr
Uniget (Linux) 