# Witr

> Use this skill when the user needs to understand why a process, service, or port is running — tracing ancestry, supervisors, containers, and service managers.

- Skill: `javimosch/witr` (Agent Skill)
- Install (CLI): `npx skillmds@latest add javimosch/witr`
- Raw SKILL.md: https://api.skillmd.com/api/skills/javimosch/witr/raw
- Safety review: PASS (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: javimosch (https://skillmd.com/u/javimosch)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/javimosch/witr

---


# witr — Why Is This Running?

CLI tool that answers "Why is this running?" by tracing process ancestry chains, supervisor relationships (systemd, launchd, Docker, PM2, tmux, SSH), containers, and service managers.

## Installation

```bash
brew install witr
```

## Commands

- `witr process explain <name>` — Explain why a process is running
- `witr process explain systemd-journald` — Explain a specific process
- `witr _ _ --exact <name>` — Exact name match (passthrough)
- `witr _ _ --pid <n>` — Explain by PID
- `witr _ _ --port <n>` — Explain what's on a port
- `witr _ _ --json <name>` — JSON output
- `witr self version` — Print version

## Usage Examples

- "Why is nginx running on this server?"
- "What process is using port 3000?"
- "Show me the ancestry chain for PID 1234"
- "What started this postgres process?"
- "Check if there's a process listening on port 8080"

## Key Features

- Explains why a process exists, not just that it exists
- Traces: systemd, launchd, Docker, Podman, PM2, cron, tmux, SSH, and more
- Detects containers, git repos, working directory, environment variables
- Detects warnings: root process, public bindings, high memory, deleted binaries
- Cross-platform: Linux, macOS, Windows, FreeBSD
- JSON output for automation