Open Source · MIT

Build on the
OSIRIS platform

OSIRIS aggregates aviation, maritime, seismic, conflict, cyber, and OSINT feeds onto a single GPU-rendered map — and exposes every one of them as a plain HTTP endpoint. This is the same API the dashboard runs on. There is no separate, privileged internal tier.

55
Endpoints
20+
Live feeds
0
Keys required
Guide

Overview

Every data point on the map is rendered through WebGL via MapLibre GL, which is what lets the interface hold thousands of concurrent entities at 60fps. The application is a Next.js app: the map and HUD run in the browser, and each live feed is normalised by a route under /api before it reaches the client.

That boundary is deliberate. Upstream sources disagree about formats, rate limits, and CORS policy, so the API layer absorbs those differences and hands back consistent JSON.

No credentials needed
Aviation, maritime, satellites, fires, earthquakes, weather, news, and CVE data all come from public keyless feeds. Keys only matter for the optional RECON scanner and for raising rate limits.
Guide

Quick Start

Every read endpoint is a plain GET returning JSON. Nothing below needs authentication — paste any of it into a terminal.

curl -s https://osirisai.live/api/flights | jq '.commercial_flights | length'

If you only need magnitudes rather than geometry, /api/stats is the right endpoint to poll — it collapses the heavy feeds into a handful of counters.

Aggregate counters
curl -s https://osirisai.live/api/stats
# { "stats": { "flights": 9241, "sats": 2043, "cctv": 2117,
#              "weather": 58, "nuclear": 191, "incidents": 412 },
#   "timestamp": "2026-07-29T12:00:00Z" }

The OSINT lookups each take one subject, so they compose cleanly in a pipeline:

Passive subdomain enumeration
curl -s "https://osirisai.live/api/osint/certs?domain=example.com" | jq -r '.subdomains[]'
Try before you write code
Every GET endpoint in the reference below has a Send request button that runs it against this instance and shows the live response.
Guide

Self-Hosting

OSIRIS needs Node 20+ and no database. A local instance is three commands:

Local development
git clone https://github.com/simplifaisoul/osiris.git
cd osiris
npm install
npm run dev        # http://localhost:3000

For a production build, or to run the checks:

Build and test
npm run build && npm start
npm run lint
npm test           # vitest
npm run test:live  # includes tests that hit live upstream feeds

A Dockerfile and docker-compose.yml ship with the repository. The container always listens on port 3000 internally; OSIRIS_PORT controls the host port it is published on.

Docker
cp .env.example .env
docker compose up -d
Guide

Configuration

Copy .env.example to .env. Read that file before filling anything in — most of the keys it lists are reserved for future sources and are not consumed by the current code.

Read by the application

SCANNER_URL / SCANNER_KEY
Points at the separate RECON scanner backend. SCANNER_KEY must equal that backend’s OSIRIS_KEY. Leave both empty to disable RECON — /api/scanner then returns 503 by design.
SDK_INGEST_KEY
Shared secret for /api/sdk/ingest. The endpoint fails closed: while this is unset, ingestion is disabled and returns 503.
OSIRIS_TELEGRAM_CHANNELS
Comma-separated public Telegram channel names (no @) for the Telegram OSINT layer, overriding the curated default set.
OSIRIS_PORT
Host port the UI is published on. The container itself always listens on 3000.

Optional — higher rate limits only

FIRMS_API_KEY, OPENSKY_CLIENT_ID, OPENSKY_CLIENT_SECRET, N2YO_API_KEY, AIS_API_KEY. The public keyless feeds are used unless you extend the code to prefer these.

Secrets hygiene
Generate secrets with openssl rand -hex 32. Never commit a populated .env — only .env.example belongs in version control.
Guide

Interface Guide

The map fills the viewport and every control floats above it. Panels are toggles rather than destinations, so you can build up exactly the picture you need and drop the rest.

Layer Panel
The left rail. Switches individual feeds on and off, and carries the theme selector.
RECON Toolkit
DNS, WHOIS, certificate transparency, IP and ASN enrichment, breach checks, sanctions, CVE lookup, port scanning.
Intel Feed
A running stream of incoming events across every enabled feed.
Region Dossier
Right-click the map for a composite summary of that location from every feed covering it.
Entity Graph
Link analysis, expanding one node at a time into its neighbours.
Status Bar
Community and docs links on the left, then a live ticker of prices and significant seismic events.
Guide

Keyboard Shortcuts

Press ? at any time inside the application to bring up this list.

FToggle fullscreen
SShare current view
LToggle layer panel
MToggle markets panel
IToggle intel feed
RReset to global view
?Show help
ESCClose panels / popups

In these docs, ⌘K (or /) opens search from anywhere on the page.

API Reference

Conventions

All routes live under /api on whatever origin serves the application. Reads are GET, writes are POST with a JSON body. Nothing requires authentication except /api/sdk/ingest and /api/github-webhook.

Errors
Failures return a non-2xx status with an `error` key, often alongside `detail` carrying the upstream message. Most routes proxy third parties, so treat upstream failure as normal — check response.ok before reading the body.
Caching
Routes set their own Cache-Control TTLs: typically 45–60s for fast-moving feeds, up to a day for static reference data. Polling faster than the TTL gains nothing but load. Where a route advertises refreshInterval, use it.
Rate limits
The three AI endpoints allow 5 requests per minute per IP and return 429 beyond that. Other routes are bounded indirectly by their upstream sources.
Timestamps
Every timestamp field is ISO 8601 in UTC.
Responsible use
The RECON scanner and /api/osint/sweep generate traffic against the targets you name. Only point them at infrastructure you own or have written authorisation to test. The remaining OSINT routes are passive and query third-party datasets rather than the subject itself.
API Reference

System

Liveness and aggregate counters. Safe to poll from monitoring.

API Reference

Aviation & Space

Aircraft, orbital objects, and heliophysics.

API Reference

Earth & Environment

Seismic, fire, atmospheric, and orbital-imagery feeds.

API Reference

Geopolitical

Conflict zones, frontlines, event streams, and country-level risk.

API Reference

Media & Markets

News aggregation, live broadcast streams, and financial instruments.

API Reference

Surveillance & Infrastructure

Camera networks, fixed infrastructure, maritime traffic, and tile/stream proxies.

API Reference

Cyber Threat

Vulnerability, attack, and malware telemetry.

API Reference

OSINT Toolkit

The lookup tools behind the RECON panel. Every route takes a single subject and returns a normalised result, so they compose well in scripts.

API Reference

Recon Scanner

Active scanning, delegated to a separate backend so the web tier never runs scans itself.

API Reference

Entity Graph

Link analysis over entities surfaced elsewhere in the platform.

API Reference

AI Analysis

Gemini-backed correlation over feed data you supply. All three are POST, all three are rate limited to 5 requests per minute per IP.

API Reference

Polybolos SDK

Push entities from an external platform into the Common Operating Picture, and stream the merged picture back out.

API Reference

Webhooks

Inbound hooks from external services.