{
  "id": "wtfis",
  "name": "wtfis",
  "homepage": "https://github.com/pirxthepilot/wtfis",
  "description": "Passive hostname, domain and IP lookup tool for non-robots",
  "executables": [
    "wtfis"
  ],
  "dotfiles": {
    "paths": [],
    "secret": [
      "~/.env.wtfis"
    ]
  },
  "commands": {
    "format": 1,
    "label": "Look up a host, domain or IP",
    "description": "Query one hostname, domain or IP address with optional enrichment services. API keys come from environment variables and are not set here.",
    "quality": "ai-draft",
    "parser": {
      "end_of_options": "--",
      "interleave": "permute",
      "long_equals": true,
      "short_attached": true,
      "short_bundles": false
    },
    "source": [
      {
        "id": "help",
        "kind": "help",
        "url": "https://github.com/pirxthepilot/wtfis/blob/main/README.md",
        "revision": "2026-10-27",
        "evidence": "positional arguments:\n  entity                Hostname, domain or IP\n\noptions:\n  -A, --all             Enable all possible enrichments\n  -s, --use-shodan      Use Shodan to enrich IPs\n  -g, --use-greynoise   Enable Greynoise for IPs\n  -a, --use-abuseipdb   Enable AbuseIPDB for IPs\n  -u, --use-urlhaus     Enable URLhaus for IPs and domains\n  -m N, --max-resolutions N\n                        Maximum number of resolutions to show (default: 3)\n  -n, --no-color        Show output without colors\n  -1, --one-column      Display results in one column\n  --geolocation-service {ip2location,ipinfo,ipwhois}\n                        Geolocation service to use (default: ipwhois)\n"
      }
    ],
    "field": [
      {
        "id": "entity",
        "label": "Hostname, domain or IP",
        "type": "string",
        "position": 0,
        "sources": [
          "help"
        ]
      },
      {
        "id": "all",
        "label": "Enable all enrichments",
        "type": "boolean",
        "option": [
          "--all",
          "-A"
        ],
        "sources": [
          "help"
        ]
      },
      {
        "id": "shodan",
        "label": "Use Shodan for IPs",
        "type": "boolean",
        "option": [
          "--use-shodan",
          "-s"
        ],
        "sources": [
          "help"
        ]
      },
      {
        "id": "greynoise",
        "label": "Use Greynoise for IPs",
        "type": "boolean",
        "option": [
          "--use-greynoise",
          "-g"
        ],
        "sources": [
          "help"
        ]
      },
      {
        "id": "abuseipdb",
        "label": "Use AbuseIPDB for IPs",
        "type": "boolean",
        "option": [
          "--use-abuseipdb",
          "-a"
        ],
        "sources": [
          "help"
        ]
      },
      {
        "id": "urlhaus",
        "label": "Use URLhaus for IPs and domains",
        "type": "boolean",
        "option": [
          "--use-urlhaus",
          "-u"
        ],
        "sources": [
          "help"
        ]
      },
      {
        "id": "max_resolutions",
        "label": "Max resolutions to show",
        "description": "Default is 3.",
        "type": "integer",
        "option": [
          "--max-resolutions",
          "-m"
        ],
        "sources": [
          "help"
        ]
      },
      {
        "id": "geolocation_service",
        "label": "Geolocation service",
        "type": "enum",
        "option": [
          "--geolocation-service"
        ],
        "choices": [
          {
            "value": "ip2location",
            "label": "ip2location"
          },
          {
            "value": "ipinfo",
            "label": "ipinfo"
          },
          {
            "value": "ipwhois",
            "label": "ipwhois (default)"
          }
        ],
        "sources": [
          "help"
        ]
      },
      {
        "id": "no_color",
        "label": "No colors",
        "type": "boolean",
        "option": [
          "--no-color",
          "-n"
        ],
        "sources": [
          "help"
        ]
      },
      {
        "id": "one_column",
        "label": "One-column output",
        "type": "boolean",
        "option": [
          "--one-column",
          "-1"
        ],
        "sources": [
          "help"
        ]
      }
    ],
    "task": [
      {
        "id": "lookup",
        "label": "Basic lookup",
        "fields": [
          "entity"
        ],
        "required": [
          "entity"
        ]
      },
      {
        "id": "full",
        "label": "Lookup with all enrichments",
        "fields": [
          "entity",
          "all"
        ],
        "required": [
          "entity"
        ],
        "set": {
          "all": [
            true
          ]
        }
      }
    ],
    "group": [
      {
        "id": "basic",
        "label": "Basic",
        "fields": [
          "entity",
          "all",
          "shodan",
          "greynoise",
          "abuseipdb",
          "urlhaus"
        ]
      },
      {
        "id": "advanced",
        "label": "Advanced",
        "fields": [
          "max_resolutions",
          "geolocation_service",
          "no_color",
          "one_column"
        ]
      }
    ]
  }
}