README

🛰️ S H A D O W B R O K E R
  Global Threat Intercept — Real-Time Geospatial Intelligence Platform
  🌐 shadowbroker.dev
  

  


---










ShadowBroker is a decentralized intelligence platform that aggregates real-time, multi-domain OSINT telemetry from 60+ live intelligence feeds into a single dark-ops map interface. Aircraft, ships, satellites, conflict zones, CCTV networks, GPS jamming, internet-connected devices, police scanners, mesh radio nodes, and breaking geopolitical events — all updating in real time on one screen, as well as an obfuscated communications protocol and information exchange infrastructure.


🛰️ Project Description

Built with Next.js, MapLibre GL, FastAPI, and Python. 40+ toggleable data layers, including SAR ground-change detection, Telegram OSINT (public channel previews geoparsed onto the map), a server-side recon toolkit (DNS, WHOIS, sanctions, BGP, IP sweep, and more), supply-chain risk overlays, and malware/C2 + CISA KEV cyber threat feeds. Multiple visual modes (DEFAULT / SATELLITE / FLIR / NVG / CRT). Right-click any point on Earth for a country dossier, head-of-state lookup, entity-graph expansion, and the latest Sentinel-2 satellite photo. ShadowBroker has no accounts, product telemetry, or analytics; the dashboard talks to your self-hosted backend. Sensitive recon and Shodan queries never hit third-party APIs from the browser — they are proxied through the backend with SSRF guards and local-operator auth. The OpenClaw / agent command channel exposes the same recon backends plus full telemetry search — no separate API integration required.

Designed for analysts, researchers, radio operators, and anyone who wants to see what the world looks like when every public signal is on the same map.


---


🌍 Why This Exists

A surprising amount of global telemetry is already public — aircraft ADS-B broadcasts, maritime AIS signals, satellite orbital data, earthquake sensors, mesh radio networks, police scanner feeds, environmental monitoring stations, internet infrastructure telemetry, and more. This data is scattered across dozens of tools and APIs. ShadowBroker combines all of it into a single interface.

The project does not introduce new surveillance capabilities — it aggregates and visualizes existing public datasets. It is fully open-source so anyone can audit exactly what data is accessed and how. ShadowBroker does not include product telemetry, analytics, or accounts. Operator-supplied keys stay in your local deployment, but live OSINT features necessarily make outbound requests to the public data providers you enable or query.



---



📡 Shodan & Recon (security-first)

ShadowBroker includes an optional Shodan connector for operator-supplied API access (SHODAN_API_KEY) and a Recon Toolkit panel for keyless OSINT lookups. Both run server-side only: the browser calls your self-hosted /api/osint/ and /api/tools/shodan/ routes; outbound requests are made by the backend after SSRF validation. Recon requires local

Top issues

Discussions

Latest release

Summary

- GT Analytics & Strategic Risk — OpenClaw-driven geopolitical analytics, risk scoring, and map overlays (392)
- Telegram OSINT auto-translate — map popups with source-language labels; Persian (fa) locale + RTL (472)
- ACARS datalink + full telemetry — Airframes datalink on plane dossiers; uncapped world telemetry
- Saved dashboard layout — layer toggles, filters, map style, and panel expand/collapse persist in localStorage
- OpenClaw hardening — entity profile/trail, fetch-health (470), agent-shell WS token auth (409)
- v0.9.84 UI — version decal and what's-new modal

 Upgra