ShadowBroker
github.com/bigbodycobain/shadowbroker- Category
- Cybersecurity
- Rank
- No. 87Tools index
- Pricing
- Open Source
- Platform
- web · desktop
- Type
- APP
- Builder
- bigbodycobain
- GitHub
- 11.1k stars
- Latest release
- v0.9.84
- Date
About
Real-time geospatial intelligence platform that aggregates 60+ OSINT feeds into a unified dark-ops interface. Track aircraft, ships, satellites, CCTV cameras, GPS jamming, and global events with AI agent integration and decentralized communications.
What it does
ShadowBroker is a self-hosted operational map for exploring public signals and running reconnaissance lookups. Operators toggle domain-specific layers, inspect mapped entities, open geographic dossiers, and query services such as DNS, WHOIS, sanctions, BGP, and Shodan. A browser dashboard routes sensitive lookups through its own backend, while an agent command channel can search telemetry and control the map.
Why it's ranked here
The breadth is unusually practical: mapping, reconnaissance, entity expansion, satellite imagery, radio links, alerts, and agent control share one operating surface. Security work is visible in SSRF checks, scoped authentication, bounded fetches, and documented outbound exposure. The verdict stays mixed because many features depend on external providers, and the communications system remains explicitly experimental rather than private.
What's good
Sensitive reconnaissance and Shodan traffic originates from the backend instead of exposing operator keys in browser requests. Local deployments have no application accounts, analytics, or product telemetry. Operators can disable selected upstream contacts, self-host map tiles, and constrain access to loopback. The project also documents trust boundaries, timeout expectations, secret handling, targeted tests, and stricter review areas.
Tradeoffs
Self-hosting does not eliminate third-party exposure. Browsers normally contact basemap providers, while enabled feeds reveal the deployment backend address to their sources. Some layers need API keys or provider accounts, and blocked scrapers can leave panels empty. The default backend allocation is 4GB, with reduced feeds advised on smaller hosts. InfoNet chat is obfuscated, not end-to-end private, and metadata privacy is not promised.
How to use it well
It suits analysts, researchers, and radio operators who want a local dashboard for correlating public telemetry, then handing focused searches to an agent or reconnaissance panel. Start with loopback access, enable only necessary feeds, set provider keys locally, and review outbound contacts before unattended deployment. Do not treat it as a source of new surveillance data, a private messenger, or protection against a compromised operator machine.
Technical notes+
The repository is a monorepo: frontend/ uses Next.js, React, and MapLibre; backend/ uses FastAPI and Python; desktop-shell/ combines Tauri, TypeScript, and Rust; privacy-core/ contains Rust primitives; and openclaw-skills/ provides agent helpers. pyproject.toml requires Python 3.10 or newer and defines a uv workspace containing backend. start-backend.js discovers or rebuilds a backend virtual environment, verifies FastAPI and Uvicorn imports, then launches the API. backend/auth.py implements admin keys, scoped tokens, loopback trust, and narrowly resolved frontend-container trust. backend/limiter.py accepts forwarded client addresses only from that trusted frontend set. backend/ais_proxy.js streams AIS over WebSocket and permits an expired-certificate fallback only after SPKI verification. docs/OUTBOUND_DATA.md records browser and backend egress, opt-outs, and remaining correlation risks; docs/mesh/threat-model.md explicitly limits privacy claims.
Observed
- Packaging and install
- Pre-built containers run through Docker Compose; Podman is supported when a Compose provider is installed.
- Primary stacks
- Monorepo using Python and FastAPI, Next.js and React, plus TypeScript and Rust for desktop and privacy components.
- Interfaces
- Browser dashboard, FastAPI backend API, built-in terminal CLI, desktop shell, and HMAC-signed agent command channel.
- Platform support
- Docker instructions cover Docker Desktop or Docker Engine; Podman guidance covers Linux, macOS, Windows, and WSL shells.
- Python requirement
- Python 3.10 or newer.
- Deployment model
- Self-hosted backend with local operator keys; enabled live-data features make outbound requests to their providers.
- Repository structure
- Separate frontend, backend, desktop shell, privacy core, deployment, and agent package areas, with documented backend and frontend test slices.
Read from README.md, Makefile, pyproject.toml, docs/OUTBOUND_DATA.md, docs/contributor-map.md, docs/production-hardening.md, docs/mesh/threat-model.md, docs/mesh/claims-reconciliation.md, docs/mesh/wormhole-dm-root-operations-runbook.md, start-backend.js, backend/auth.py, backend/limiter.py, backend/gate_sse.py, backend/ais_proxy.js, backend/node_state.py.
What it can do
Track aircraft in real-time
Aircraft tracking data feeds → Live aircraft position and flight information
Monitor ships and maritime traffic
Maritime tracking data feeds → Real-time ship locations and vessel information
Track satellites and space objects
Satellite monitoring data feeds → Satellite positions and orbital information
Access CCTV camera networks
CCTV network data feeds → Live camera feeds and surveillance data
Detect GPS jamming activities
GPS interference monitoring feeds → GPS jamming alerts and location data
Monitor global geopolitical events
Breaking news and event data feeds → Real-time geopolitical intelligence reports
Aggregate multiple OSINT data sources
60+ open source intelligence feeds → Unified intelligence dashboard
Enable decentralized communications
Mesh network protocols and user messages → Secure distributed communication channels
Tags
Tech Stack
Comments (0)
No comments yet
Editorially curated, with community endorsements as a secondary signal. Corrections welcome.