Build on the
OSIRIS platform
OSIRIS aggregates aviation, maritime, seismic, conflict, cyber, and OSINT feeds onto a single GPU-rendered map — and exposes every one of them as a plain HTTP endpoint. This is the same API the dashboard runs on. There is no separate, privileged internal tier.
Overview
Every data point on the map is rendered through WebGL via MapLibre GL, which is what lets the interface hold thousands of concurrent entities at 60fps. The application is a Next.js app: the map and HUD run in the browser, and each live feed is normalised by a route under /api before it reaches the client.
That boundary is deliberate. Upstream sources disagree about formats, rate limits, and CORS policy, so the API layer absorbs those differences and hands back consistent JSON.
Quick Start
Every read endpoint is a plain GET returning JSON. Nothing below needs authentication — paste any of it into a terminal.
curl -s https://osirisai.live/api/flights | jq '.commercial_flights | length'If you only need magnitudes rather than geometry, /api/stats is the right endpoint to poll — it collapses the heavy feeds into a handful of counters.
curl -s https://osirisai.live/api/stats
# { "stats": { "flights": 9241, "sats": 2043, "cctv": 2117,
# "weather": 58, "nuclear": 191, "incidents": 412 },
# "timestamp": "2026-07-29T12:00:00Z" }The OSINT lookups each take one subject, so they compose cleanly in a pipeline:
curl -s "https://osirisai.live/api/osint/certs?domain=example.com" | jq -r '.subdomains[]'Self-Hosting
OSIRIS needs Node 20+ and no database. A local instance is three commands:
git clone https://github.com/simplifaisoul/osiris.git
cd osiris
npm install
npm run dev # http://localhost:3000For a production build, or to run the checks:
npm run build && npm start
npm run lint
npm test # vitest
npm run test:live # includes tests that hit live upstream feedsA Dockerfile and docker-compose.yml ship with the repository. The container always listens on port 3000 internally; OSIRIS_PORT controls the host port it is published on.
cp .env.example .env
docker compose up -dConfiguration
Copy .env.example to .env. Read that file before filling anything in — most of the keys it lists are reserved for future sources and are not consumed by the current code.
Read by the application
Optional — higher rate limits only
FIRMS_API_KEY, OPENSKY_CLIENT_ID, OPENSKY_CLIENT_SECRET, N2YO_API_KEY, AIS_API_KEY. The public keyless feeds are used unless you extend the code to prefer these.
openssl rand -hex 32. Never commit a populated .env — only .env.example belongs in version control.Interface Guide
The map fills the viewport and every control floats above it. Panels are toggles rather than destinations, so you can build up exactly the picture you need and drop the rest.
Keyboard Shortcuts
Press ? at any time inside the application to bring up this list.
In these docs, ⌘K (or /) opens search from anywhere on the page.
Conventions
All routes live under /api on whatever origin serves the application. Reads are GET, writes are POST with a JSON body. Nothing requires authentication except /api/sdk/ingest and /api/github-webhook.
/api/osint/sweep generate traffic against the targets you name. Only point them at infrastructure you own or have written authorisation to test. The remaining OSINT routes are passive and query third-party datasets rather than the subject itself.System
Liveness and aggregate counters. Safe to poll from monitoring.
Aviation & Space
Aircraft, orbital objects, and heliophysics.
Earth & Environment
Seismic, fire, atmospheric, and orbital-imagery feeds.
Geopolitical
Conflict zones, frontlines, event streams, and country-level risk.
Media & Markets
News aggregation, live broadcast streams, and financial instruments.
Surveillance & Infrastructure
Camera networks, fixed infrastructure, maritime traffic, and tile/stream proxies.
Cyber Threat
Vulnerability, attack, and malware telemetry.
OSINT Toolkit
The lookup tools behind the RECON panel. Every route takes a single subject and returns a normalised result, so they compose well in scripts.
Recon Scanner
Active scanning, delegated to a separate backend so the web tier never runs scans itself.
Entity Graph
Link analysis over entities surfaced elsewhere in the platform.
AI Analysis
Gemini-backed correlation over feed data you supply. All three are POST, all three are rate limited to 5 requests per minute per IP.
Polybolos SDK
Push entities from an external platform into the Common Operating Picture, and stream the merged picture back out.
Webhooks
Inbound hooks from external services.