pinspect — Linux Process Intelligence CLI

Fast, deep Linux process inspection and forensic intelligence that goes far beyond ps aux.

PyPI version Python versions License: MIT

pinspect is an all-in-one terminal tool for systems engineers, SREs, and security investigators. It collects deep, actionable intelligence about running processes directly from native Linux /proc and kernel interfaces — zero external command dependencies, low overhead, graceful error recovery, and SIEM/EDR-ready output.

📦 Installation

Install with pipx (recommended — isolated environment):

pipx install pinspect-cli

Or with plain pip:

pip install pinspect-cli

⚡ Quick Start

pinspect ps                 # deep process list
pinspect show 1234          # full intelligence card for one PID
pinspect tree               # process hierarchy
pinspect security 1234      # capabilities, seccomp, LSM + risk score

✨ Highlights

  • Origin intelligence — detects systemd, cron, SSH, shell, Docker/Podman/Kubernetes, or kernel launch origins; resolves service units and container IDs
  • Security forensics — decodes capability bitmasks, Seccomp, NoNewPrivs, AppArmor/SELinux, SetUID/SetGID, executable SHA-256 hashes, deleted-binary execution
  • Risk scoring — every process gets a heuristic suspicion score (0–100) with explainable flags: deleted/memfd executables, RWX memory regions, dangerous capabilities, unsandboxed root
  • Memory map forensics — flags code-injection evidence: W+X regions, anonymous executable mappings, fileless payloads, files deleted after mapping
  • Files & sockets — open FDs, deleted files held open, per-PID or system-wide socket mapping
  • Containers — list only containerized processes with runtime, container ID, and name
  • Secret redaction — env automatically masks tokens, keys, passwords, and credentials
  • Built-in grep — search running processes by name, arguments, executable, or user; scriptable exit codes
  • Interactive TUI — live dashboard with filtering, sorting, and multi-tab detail views
  • SIEM / EDR formats — structured --json, --csv, --quiet, and --wide on every subcommand

📖 Documentation

Document Contents
Installation PyPI, pipx, and from-source installs
Command Reference All 13 subcommands with examples
Output Formats JSON, CSV, quiet, wide modes for pipelines
Security & Forensics Risk scoring model, maps forensics, capability analysis

🧪 Testing

python3 -m unittest discover -s tests -p "test_*.py" -v

📜 License

MIT — see LICENSE.

Project links

Data verified by PyPI on Aug 23, 2026
Data provided by the project maintainers, verified at the time the release was uploaded to PyPI.

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Latest release

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for baba01hacker from gravatar.com baba01hacker

Credits

Author: Baba01hacker666

GitHub Statistics

Data verified by PyPI on Aug 23, 2026
The GitHub source repository was provided by the project maintainers and verified by PyPI at the time of upload. Stars, forks, and open issues/PRs are derived from that repository and have not been independently verified.

License

MIT License

Requires

Python >=3.8

Tags

linux procfs process cli security forensics tui edr siem system-monitoring process-intelligence process-tree systemd cgroups namespaces capabilities pstree lsof terminal-ui devops sre sysadmin incident-response secret-redaction

Classifiers

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

pinspect_cli-1.0.3.tar.gz (60.2 kB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

pinspect_cli-1.0.3-py3-none-any.whl (79.5 kB view details)

Uploaded Python 3

File details

Details for the file pinspect_cli-1.0.3.tar.gz.

File metadata

  • Download URL: pinspect_cli-1.0.3.tar.gz
  • Upload date:
  • Size: 60.2 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for pinspect_cli-1.0.3.tar.gz
Algorithm Hash digest
SHA256 7814db9a953a864c35fdc72e501a8d357e66f4f10175af2cdb3d0644fb7eed35
MD5 2237be7f11f7e45bc8048a577900b3c8
BLAKE2b-256 cc5f47e5b8fc8872d5ff931fb269a50dae7dced5eac0cc2cf2290d42c6e23c76

See more details on using hashes here.

Provenance

The following attestation bundles were made for pinspect_cli-1.0.3.tar.gz:

Publisher: publish.yml on Baba01hacker666/pinspect

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file pinspect_cli-1.0.3-py3-none-any.whl.

File metadata

  • Download URL: pinspect_cli-1.0.3-py3-none-any.whl
  • Upload date:
  • Size: 79.5 kB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for pinspect_cli-1.0.3-py3-none-any.whl
Algorithm Hash digest
SHA256 32e78caaad8109e4ca13535a20dd2af67051bd056c1b2492e473e05f9cb883e3
MD5 51ee308d50f5f540262a1ecd1e587ec9
BLAKE2b-256 050572bcb466a40fe0f811f97ec2053ca551d258cb92c373ae5160acf769f11c

See more details on using hashes here.

Provenance

The following attestation bundles were made for pinspect_cli-1.0.3-py3-none-any.whl:

Publisher: publish.yml on Baba01hacker666/pinspect

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Release history Release notifications | RSS feed

This release

1.0.3 This release

2 files

1.0.2

2 files

1.0.0

2 files

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page