Shadowbroker

11.3K stars
AGPL-3.0
Active this week
Last commit 2 days ago

Last verified Oct 22, 2026

Monitor aircraft, ships, satellites, CCTV, and 60+ real-time intelligence feeds on a self-hosted geospatial map. AGPL-3.0, no accounts.

Visit website GitHub11.3K Deploy on Hostinger

Read the full breakdownWho it is for, how it works, trade-offs, the quick start and the FAQ

who it's for

Who Shadowbroker is for#

Security analysts tracking aircraft and maritime activity

Shadowbroker overlays ADS-B flight paths, AIS vessel tracks, and satellite passes alongside GPS jamming zone detection and CISA KEV cyber threat feeds on a single map. Cross-referencing an aircraft registration against OFAC sanctions data and BGP ownership takes one right-click and a recon panel lookup.

Skip if:

Skip if you need a case-management or incident-response workflow with ticketing and attribution history. Shadowbroker is a live monitoring and correlation layer, not an investigation management system.

OSINT researchers monitoring geopolitical events

Telegram conflict channel posts from public OSINT sources such as OSINTdefender and NEXTA are geoparsed hourly and pinned to metro anchors alongside active wildfire data, earthquake events, and conflict zone overlays. Right-clicking any location pulls a country dossier and the latest Sentinel-2 satellite photo at 10-meter resolution.

Skip if:

Skip if your research requires reliable end-to-end-encrypted communications with collaborators. InfoNet communications are experimental and explicitly not private in the current build.

Home-lab operators and radio enthusiasts

KiwiSDR shortwave radio nodes and police scanner feeds are clickable in the dashboard for live audio. Meshtastic mesh radio nodes and APRS amateur radio networks appear on the map and integrate with the Mesh Chat panel. The platform is designed for operators who run SDR hardware and want their radio landscape overlaid with global telemetry.

Skip if:

Skip if you need mobile or offline access. Shadowbroker is a browser-based dashboard that requires a running self-hosted backend to function.

Supply chain and infrastructure risk monitoring

The SCM panel scores Tier 1 and Tier 2 semiconductor and battery manufacturing sites against nearby earthquake, wildfire, and conflict events in real time. Military base locations, 35,000+ power plants, and 2,000+ data centers are mappable layers that cross-reference against current global incident data automatically.

Skip if:

Skip if your organization's compliance policy prohibits AGPL-licensed tooling in production systems. AGPL source-disclosure terms apply to any network-facing deployment of a modified version.

the problem

The problem it solves#

Global public intelligence signals are fragmented across dozens of separate tools and APIs. An analyst tracking a corporate aircraft must query Flightradar24 or an ADS-B exchange, then switch to MarineTraffic for vessel positions, then check Space-Track for satellite data, then open Shodan for IP recon, and then consult a separate map for earthquake or conflict overlays. There is no single free tool that aggregates all of these streams while also providing a recon toolkit and a self-hosted backend that keeps operator queries off third-party analytics pipelines.

The deeper pain is data correlation. Spotting that an aircraft over a conflict zone crosses a GPS jamming region while an anomalous Shodan host appears on the same subnet requires context-switching across multiple browser tabs. Commercial intelligence platforms address this with managed backends, but they require enterprise contracts, offer no self-hosted option, and route every query through vendor infrastructure.

how Shadowbroker solves it

How it solves it#

60+ Live Intelligence Feeds

Aggregates ADS-B aircraft transponders, AIS vessel positions, satellite orbital tracks, CCTV streams across six countries, earthquake sensors, wildfire alerts via NASA FIRMS, GPS jamming zones, mesh radio nodes, and police scanner feeds. Every layer updates in real time and is individually toggleable from the map interface.

AI Agent Command Channel

The HMAC-signed OpenClaw command channel gives any compatible AI agent full read/write access to all 40+ data layers, cross-layer telemetry search, the server-side recon toolkit, entity-graph expansion, and map control. Claude, GPT, LangChain, and any agent that speaks the protocol are supported with no separate API integration required.

Server-Side Recon Toolkit

A sidebar panel runs IP geolocation, DNS lookup, RDAP/WHOIS, certificate transparency, BGP/ASN analysis, OFAC sanctions search, CVE lookup, and Tor/OTX threat checks. All requests are proxied through the backend after SSRF validation so the browser never makes outbound recon queries directly.

SAR Ground-Change Detection

Detects millimeter-scale ground deformation, flood extent, and vegetation disturbance through cloud cover using NASA OPERA and Copernicus EGMS SAR satellite data. Operators define watch areas and receive anomaly alerts. A free NASA Earthdata account is required to activate this layer.

Multiple Visual Display Modes

Switches between DEFAULT, SATELLITE, FLIR (thermal), NVG (night vision), and CRT (retro terminal) map display modes via the STYLE button. Right-clicking any point on Earth returns a country dossier with head-of-state data, population, languages, a Wikipedia summary, and the latest Sentinel-2 satellite photo at 10-meter resolution.

InfoNet Decentralized Mesh (Experimental)

An optional messaging and governance layer built on Tor and Reticulum transport, with gate personas, Ed25519 signing, and AESGCM encryption. The README designates this an experimental testnet: messages are obfuscated but not end-to-end encrypted, and the project explicitly states no privacy guarantee on any channel in the current build.

strengths · trade-offs

Strengths and trade-offs#

Strengths

No Accounts, No Telemetry, No AnalyticsThe dashboard communicates only with your self-hosted backend. Operator API keys for Shodan, NASA Earthdata, and other services stay in your local .env file and are never transmitted to Shadowbroker infrastructure. There is no product analytics system, no usage reporting, and no central account requirement.
All Recon Queries Proxied Server-SideShodan queries and recon lookups are proxied through the self-hosted backend after SSRF validation, not issued from the browser directly. Sensitive IP lookups, sanctions checks, and Shodan results never appear in browser network logs or pass through third-party proxies.
Docker Compose Quick Start, No Local BuildBoth the Next.js frontend and FastAPI backend ship as pre-built GHCR container images. A git clone followed by docker compose pull and docker compose up -d gets the full stack running on port 3000. Kubernetes and Helm charts are also available for home-lab cluster deployments.
AI Integration Without Custom API WorkThe agentic command channel uses HMAC signing and exposes all 40+ data layers, cross-layer search, and the full recon toolkit without a separate API integration. Any agent that speaks the documented protocol gets the same access as the operator dashboard.

Trade-offs

-Backend Requires 4GB RAM by DefaultThe default Docker Compose configuration allocates 4GB to the backend container. Systems with less available memory risk OOM restarts when memory-intensive layers are enabled. The README documents a BACKEND_MEMORY_LIMIT environment variable and recommends disabling unused feeds on constrained hosts.
-InfoNet Communications Are Not PrivateThe InfoNet decentralized mesh is an experimental testnet. Gate Chat messages are obfuscated with Tor and Reticulum transport but are not end-to-end encrypted. The README explicitly states that metadata is not hidden and advises treating all InfoNet channels as open and public until E2E encryption is added in a future release.
-AGPL-3.0 Restricts Managed Service ResaleAGPL-3.0 permits running Shadowbroker for internal team or commercial use without restriction and allows free modification. The constraint applies when distributing a modified version as a hosted network service: doing so requires releasing the source changes. Operators self-hosting for their own teams are unaffected.

versus alternatives

Shadowbroker vs alternatives#

Shadowbroker vs Recorded Future

Recorded Future is a managed threat intelligence platform that aggregates news feeds, dark web signals, and technical indicators for enterprise security teams. Shadowbroker covers similar telemetry territory but focuses on live geospatial feeds (aircraft, vessels, satellites, CCTV) rather than threat actor attribution, and runs entirely on operator-owned infrastructure rather than a vendor-managed cloud.

Feature	Shadowbroker	Recorded Future
License	AGPL-3.0	Proprietary
Self-hosting	Yes (Docker Compose)	No
Pricing	Free (server costs only)	Enterprise contract
Live flight, vessel, satellite tracking	Yes	No
Threat intel feeds	CISA KEV, abuse.ch, OTX	Extensive managed feeds
AI agent integration	Native HMAC channel	API-based

Shadowbroker is the better choice for analysts who need real-time geospatial telemetry: live aircraft positions, vessel tracks, GPS jamming zones, and satellite imagery on one map with no vendor contract required. Recorded Future is the better choice for enterprise teams that need structured threat actor attribution, dark web monitoring, and analyst-team collaboration backed by vendor support.

Shadowbroker vs Maltego

Maltego is a link-analysis and OSINT investigation tool that maps relationships between entities such as domains, IP addresses, and persons. The two tools overlap on recon enrichment: Shadowbroker runs DNS, WHOIS, BGP, and sanctions lookups from its sidebar panel; Maltego runs similar enrichments via transforms. Shadowbroker adds a live geospatial map layer that Maltego does not provide.

Feature	Shadowbroker	Maltego
License	AGPL-3.0	Proprietary
Self-hosting	Yes	Community edition only; full features require a managed account
Pricing	Free	Free Community tier; Professional from $999/yr
Real-time geospatial map	Yes	No
IP, WHOIS, DNS recon	Yes (server-side)	Yes (via transforms)
Entity graph	Yes	Yes (core feature)

Maltego is the better choice for investigations centered on entity relationships, such as tracing a phishing domain to a threat actor network through linked infrastructure. Shadowbroker is the better choice when the investigation is geospatially anchored: tracking physical assets, correlating satellite imagery with conflict events, or monitoring global infrastructure on a live map.

install · quick start

Quick start#

bash

Deploy Shadowbroker with Docker Compose using pre-built container images.
```bash
git clone https://github.com/bigbodycobain/Shadowbroker.git
cd Shadowbroker
docker compose pull
docker compose up -d
```

tech stack · detected from GitHub

What it's built on#

Languages: JavaScriptPythonRustTypeScript
Frameworks: Next.jsReact

frequently asked

FAQ#

Is Shadowbroker free to use?

Yes. Shadowbroker is open source under AGPL-3.0 and free to self-host. You pay only for your server resources. Some data layers require free third-party accounts such as NASA Earthdata for SAR satellite imagery or an operator-supplied Shodan API key. The core platform has no licensing cost.

What server resources are required to self-host Shadowbroker?

The default Docker Compose setup allocates 4GB RAM to the backend container. Docker Desktop or Docker Engine is required on Linux, macOS, or Windows. Port 3000 serves the frontend; port 8000 is the backend API and can be remapped via a BACKEND_PORT variable in .env if another service already occupies it. Systems with less than 4GB available should disable memory-intensive feed layers or set the BACKEND_MEMORY_LIMIT variable.

Does Shadowbroker track or log user activity?

No. The platform has no accounts, no product telemetry, and no analytics. The dashboard communicates only with your self-hosted backend. Operator-supplied API keys stay in your local .env file. Live OSINT features make outbound requests to the public data providers you enable, but no query data passes through Shadowbroker infrastructure.

Can I connect an AI agent to Shadowbroker?

Yes. The HMAC-signed OpenClaw command channel exposes all 40+ data layers, cross-layer telemetry search, the full server-side recon toolkit, entity-graph expansion, pin placement, and map control to any compatible AI agent. Claude, GPT, LangChain, and custom agents are supported. No separate API integration is required beyond speaking the protocol.

Is the InfoNet messaging layer safe for sensitive communications?

No. InfoNet is an experimental testnet, not a private messenger. The README explicitly states that Gate Chat messages are obfuscated with Tor and Reticulum transport but are not end-to-end encrypted and that metadata is not hidden. Dead Drop DMs are the strongest current lane, but even those are described as not yet confirmed private. The project advises treating all InfoNet channels as open and public until E2E encryption is added in a future release.

also worth a look

Similar open-source tools#

Worldmonitor

Alternative toSeerist

Self-hosted geopolitical risk map: 58 layer types, 469 OSINT feeds.

88,941 GitHub stars
Licence AGPL-3.0

flowsint

Alternative toMaltego

Self-hosted graph tool for OSINT and cybersecurity investigations

9,878 GitHub stars
Licence Apache-2.0

Prometheus

Alternative toDatadog

Time series monitoring with a dimensional model and PromQL query language.

66,672 GitHub stars
Licence Apache-2.0

Local Deep Research

Alternative toPerplexity AI

Your AI research assistant, fully local and encrypted.

9,372 GitHub stars
Licence MIT

Maigret

Alternative toSocial Links

Collect OSINT data by username effortlessly

39,239 GitHub stars
Licence MIT

ClawMetry

Alternative toArize AI

Real-time observability dashboard for AI coding agents

436 GitHub stars
Licence MIT

by category

Open source tools in these categories#

125

Security & Monitoring

REA (Reverse Engineer Anything), RustDesk, Uptime Kuma 104

Data & Analytics

Firecrawl, ragflow, Worldmonitor

Hostinger

Run Shadowbroker on your own server

Self-host Shadowbroker on a Hostinger VPS.

Deploy on Hostinger

Featured

Omnara

Alternative toClaude Managed Agents

Open-source agent deployment API. Self-host or use Omnara Cloud.

2,957 GitHub stars
Licence Apache-2.0
#AI Agents

Inbox Zero

Alternative toSuperhuman

AI email assistant that drafts replies and clears your inbox

12,712 GitHub stars
Licence AGPL-3.0
#Email

rakazo

Alternative toGrok Bot

AI teammates you own: your keys, your model, your machine.

4,904 GitHub stars
Licence Apache-2.0
#AI Agents

Feature your project

The projects we add and every new guide. Free, unsubscribe any time.

Find open source alternatives to paid software

Shadowbroker vs Recorded Future

Feature	Shadowbroker	Recorded Future
License	AGPL-3.0	Proprietary
Self-hosting	Yes (Docker Compose)	No
Pricing	Free (server costs only)	Enterprise contract
Live flight, vessel, satellite tracking	Yes	No
Threat intel feeds	CISA KEV, abuse.ch, OTX	Extensive managed feeds
AI agent integration	Native HMAC channel	API-based

Shadowbroker vs Maltego

Feature	Shadowbroker	Maltego
License	AGPL-3.0	Proprietary
Self-hosting	Yes	Community edition only; full features require a managed account
Pricing	Free	Free Community tier; Professional from $999/yr
Real-time geospatial map	Yes	No
IP, WHOIS, DNS recon	Yes (server-side)	Yes (via transforms)
Entity graph	Yes	Yes (core feature)