id       = "wtfis"
name     = "wtfis"
homepage = "https://github.com/pirxthepilot/wtfis"
description = "Passive hostname, domain and IP lookup tool for non-robots"
executables   = ["wtfis"]

[dotfiles]

# https://github.com/pirxthepilot/wtfis — the README documents ~/.env.wtfis
# as the optional file for VirusTotal and other API settings.
paths = []
secret = ["~/.env.wtfis"]

[commands]
format = 1
label = "Look up a host, domain or IP"
description = "Query one hostname, domain or IP address with optional enrichment services. API keys come from environment variables and are not set here."
quality = "ai-draft"
parser = { end_of_options = "--", interleave = "permute", long_equals = true, short_attached = true, short_bundles = false }

[[commands.source]]
id = "help"
kind = "help"
url = "https://github.com/pirxthepilot/wtfis/blob/main/README.md"
revision = "2026-10-27"
evidence = """
positional arguments:
  entity                Hostname, domain or IP

options:
  -A, --all             Enable all possible enrichments
  -s, --use-shodan      Use Shodan to enrich IPs
  -g, --use-greynoise   Enable Greynoise for IPs
  -a, --use-abuseipdb   Enable AbuseIPDB for IPs
  -u, --use-urlhaus     Enable URLhaus for IPs and domains
  -m N, --max-resolutions N
                        Maximum number of resolutions to show (default: 3)
  -n, --no-color        Show output without colors
  -1, --one-column      Display results in one column
  --geolocation-service {ip2location,ipinfo,ipwhois}
                        Geolocation service to use (default: ipwhois)
"""

[[commands.field]]
id = "entity"
label = "Hostname, domain or IP"
type = "string"
position = 0
sources = ["help"]

[[commands.field]]
id = "all"
label = "Enable all enrichments"
type = "boolean"
option = ["--all", "-A"]
sources = ["help"]

[[commands.field]]
id = "shodan"
label = "Use Shodan for IPs"
type = "boolean"
option = ["--use-shodan", "-s"]
sources = ["help"]

[[commands.field]]
id = "greynoise"
label = "Use Greynoise for IPs"
type = "boolean"
option = ["--use-greynoise", "-g"]
sources = ["help"]

[[commands.field]]
id = "abuseipdb"
label = "Use AbuseIPDB for IPs"
type = "boolean"
option = ["--use-abuseipdb", "-a"]
sources = ["help"]

[[commands.field]]
id = "urlhaus"
label = "Use URLhaus for IPs and domains"
type = "boolean"
option = ["--use-urlhaus", "-u"]
sources = ["help"]

[[commands.field]]
id = "max_resolutions"
label = "Max resolutions to show"
description = "Default is 3."
type = "integer"
option = ["--max-resolutions", "-m"]
sources = ["help"]

[[commands.field]]
id = "geolocation_service"
label = "Geolocation service"
type = "enum"
option = ["--geolocation-service"]
choices = [
  { value = "ip2location", label = "ip2location" },
  { value = "ipinfo", label = "ipinfo" },
  { value = "ipwhois", label = "ipwhois (default)" },
]
sources = ["help"]

[[commands.field]]
id = "no_color"
label = "No colors"
type = "boolean"
option = ["--no-color", "-n"]
sources = ["help"]

[[commands.field]]
id = "one_column"
label = "One-column output"
type = "boolean"
option = ["--one-column", "-1"]
sources = ["help"]

[[commands.task]]
id = "lookup"
label = "Basic lookup"
fields = ["entity"]
required = ["entity"]

[[commands.task]]
id = "full"
label = "Lookup with all enrichments"
fields = ["entity", "all"]
required = ["entity"]
set = { all = [true] }

[[commands.group]]
id = "basic"
label = "Basic"
fields = ["entity", "all", "shodan", "greynoise", "abuseipdb", "urlhaus"]

[[commands.group]]
id = "advanced"
label = "Advanced"
fields = ["max_resolutions", "geolocation_service", "no_color", "one_column"]