Shadowbroker

ShadowBroker is a self-hosted, open-source intelligence (OSINT) platform that aggregates real-time, multi-domain telemetry from more than 60 live data feeds into a single dark-ops style map interface. Aircraft ADS-B broadcasts, maritime AIS traffic, satellite orbital data, seismic sensors, CCTV camera networks, GPS jamming zones, police scanners, mesh radio nodes, and breaking geopolitical events all update live on one screen, letting analysts, researchers, and radio operators see correlations that would otherwise require juggling dozens of separate tools and APIs.

Beyond passive visualization, ShadowBroker ships a server-side recon toolkit (DNS, WHOIS, RDAP, BGP/ASN, OFAC sanctions, CVE and Tor/OTX threat lookups, subnet sweeps) and an optional Shodan connector for searching internet-connected devices, all proxied through the backend with SSRF guards so sensitive queries never leave the operator’s own deployment. A cross-layer correlation engine flags composite events — like GPS jamming combined with an internet outage in the same region — that no single feed would surface alone, and an entity-graph panel expands aircraft, vessels, companies, and IPs into linked profiles pulled from Wikidata, OFAC, and the platform’s own store.

The project is built with Next.js and MapLibre GL on the frontend and FastAPI/Python on the backend, ships as prebuilt Docker images with no required accounts or product telemetry, and includes an HMAC-signed agentic command channel so an AI agent (Claude, GPT, LangChain, or the project’s own OpenClaw) can read every layer and take actions on the map alongside a human operator. A separate InfoNet component adds an experimental peer-to-peer mesh for obfuscated messaging between ShadowBroker nodes, independent of the core intelligence dashboard.

What You Get

• 60+ live OSINT data layers spanning ADS-B flight tracking, AIS vessel traffic, satellite orbits, CCTV feeds, seismic sensors, GPS jamming detection, and geopolitical news, all rendered on one MapLibre GL map.
• A server-side recon toolkit for DNS, WHOIS/RDAP, BGP/ASN, OFAC sanctions, CVE, and Tor/OTX lookups, plus an optional Shodan connector, all proxied through the backend with SSRF guards.
• A cross-layer correlation engine that surfaces composite alerts — like GPS jamming plus internet outages in the same region — that no single feed would reveal on its own.
• An HMAC-signed agentic command channel that gives AI agents (Claude, GPT, LangChain, or OpenClaw) full read/write access to every data layer, recon tool, and map control.
• Multiple visual modes (SATELLITE, FLIR, NVG, CRT) and an entity-graph panel that expands any aircraft, vessel, company, or IP into a linked profile.
• An experimental InfoNet mesh for obfuscated peer-to-peer messaging between self-hosted ShadowBroker nodes, with a built-in terminal CLI.

Common Use Cases

• OSINT analysts and journalists correlating aircraft, maritime, and news signals to verify breaking events in real time.
• Security researchers running recon (WHOIS, BGP, Shodan, CVE) against a target’s public footprint without exposing queries to third-party SaaS tools.
• Radio and SDR hobbyists tuning into KiwiSDR shortwave nodes and police scanner feeds directly from the map.
• Teams monitoring supply-chain risk by cross-referencing semiconductor/battery fab locations against nearby earthquakes, wildfires, and conflict events.
• Developers connecting an AI agent as a co-analyst that can search telemetry, run recon lookups, and place pins autonomously.

Under The Hood

Architecture ShadowBroker is a two-tier system: a Next.js/MapLibre GL frontend (frontend/src/app, components, hooks) that renders the live map and layer toggles, and a FastAPI/Python backend (backend/main.py, backend/routers/*) that fans out to dozens of independent fetchers (backend/services/fetchers/) for each OSINT feed. Feed data flows through a shared feed_ingester and data_fetcher layer into a correlation_engine that scans co-located events across layers on a geographic grid and emits composite alerts, while a separate entity_graph router expands any selected object into a linked profile. Sensitive recon (osint.py, tools.py routers) and Shodan queries are proxied server-side with SSRF guards rather than called from the browser, and an HMAC-signed agent command channel sits alongside the human-facing API so an external LLM agent can drive the same map and recon surface. A largely independent mesh subsystem (30+ modules under backend/services/mesh/) implements the experimental InfoNet peer-to-peer messaging protocol, decoupled from the core intelligence dashboard so it can evolve — or fail — without affecting live-feed rendering.

Tech Stack The backend runs on FastAPI 0.136 with Uvicorn, Pydantic v2, APScheduler for scheduled feed refresh, slowapi for rate limiting, and a large set of domain-specific libraries (sgp4 for satellite propagation, reverse-geocoder, vaderSentiment, meshtastic, PyNaCl for mesh cryptography, pystac-client for satellite imagery). An optional dependency group adds geopandas/osmnx/rasterio/scikit-learn for road-corridor and SAR ground-change analysis. The frontend is Next.js 16 with React 19, MapLibre GL and react-map-gl for mapping, satellite.js for orbit rendering, Tailwind CSS v4, and Zod for validation; a desktop shell wraps the same frontend in Tauri. Everything ships as prebuilt Docker/GHCR images with a docker-compose stack, and a companion GitLab CI pipeline produces byte-identical images from the mirrored repo.

Code Quality The backend carries over 260 pytest test files (backend/tests/) covering individual fetchers, mesh cryptography, control-surface auth, and regression baselines, run through uv run pytest and linted with ruff (with a documented, narrowly-scoped ignore list for legacy modules); the frontend has close to 100 Vitest test files, including dedicated suites for mesh identity, gate decryption, and desktop bridge routing, run in CI alongside ESLint. Naming and module boundaries are consistent (one file per feed/router/service), error handling favors explicit logging over silent swallowing in the modules reviewed, and both pyproject.toml files pin dependency versions tightly for reproducible builds. A .pre-commit-config.yaml and comments in the ruff/black config acknowledge historical style debt in older modules rather than hiding it.

What Makes It Unique Few open-source OSINT tools attempt ShadowBroker’s breadth in one place — combining ADS-B, AIS, satellite, seismic, CCTV, radio, and cyber-threat feeds with a cross-layer correlation engine that generates hypotheses (not verdicts) from co-located anomalies across otherwise unrelated data sources. Its HMAC-signed agentic command channel, giving an LLM agent the same read/write map control and recon toolkit as a human operator, and its experimental InfoNet mesh for operator-to-operator messaging without any central account system, are both comprehensive and unusual design choices among comparable geospatial-intelligence dashboards.

Self-Hosting

Licensing Model AGPL-3.0 licensed — all features, including the recon toolkit, Shodan connector, agentic command channel, and mesh networking, are available in self-hosted deployments with no restrictions or license keys required.

Self-Hosting Restrictions None found. No ee/, enterprise/, pro/, or cloud/ directories exist in the repository, and no license-check code (requiresLicense, isPro, isEnterprise) was found in the source.

Cloud vs Self-Hosted There is no hosted cloud offering — the dashboard talks only to a self-hosted backend, and the project explicitly states it has no accounts, product telemetry, or analytics.

License Key Required No. Some optional features (Shodan search, NASA Earthdata for SAR ground-change alerts) require the operator to supply their own free third-party API key, but this is unrelated to any project license key.