Osiris is a production-grade OSINT platform that provides situational awareness across multiple intelligence domains. Built with Next.js 16 and MapLibre GL, every data point is rendered via WebGL for 60fps performance even with thousands of concurrent entities on-screen.

┌─────────────────────────────────────────────────┐
│                  OSIRIS CLIENT                   │
│  ┌──────────┐  ┌──────────┐  ┌───────────────┐ │
│  │ MapLibre  │  │  HUD     │  │  RECON Toolkit│ │
│  │  GL (GPU) │  │ Panels   │  │  Port Scan    │ │
│  │  WebGL    │  │ Layers   │  │  DNS / WHOIS  │ │
│  │  Render   │  │ Controls │  │  Vuln Scanner │ │
│  └──────────┘  └──────────┘  └───────────────┘ │
├─────────────────────────────────────────────────┤
│               NEXT.JS API ROUTES                 │
│  /api/flights         /api/earthquakes          │
│  /api/cctv            /api/news                 │
│  /api/fires           /api/maritime             │
│  /api/gdelt           /api/satellites           │
│  /api/weather         /api/scanner              │
│  /api/sentinel        /api/telegram-feed        │
│  /api/osint/*  (whois, dns, ip, cve, sanctions, │
│                 crypto, sweep, threats, …)      │
├─────────────────────────────────────────────────┤
│              EXTERNAL DATA SOURCES               │
│  OpenSky · USGS · NASA · NOAA · TfL · NVD      │
│  GDACS · EONET · FIRMS · N2YO · RSS Feeds      │
│  blockstream.info · Blockscout · OpenSanctions  │
│  t.me public previews                            │
└─────────────────────────────────────────────────┘

• 16 toggleable data layers with real-time entity counts
• GPU-accelerated rendering — all map data rendered via WebGL, not DOM
• Progressive loading — data fetched on-demand when layers are activated
• Viewport-aware — only loads relevant data for the visible region

• Port Scanner — TCP connect scan with service fingerprinting
• DNS Lookup — Full record resolution (A, AAAA, MX, NS, TXT, CNAME)
• WHOIS — Domain/IP registration data (auto-cross-checked against OFAC SDN)
• SSL/TLS Inspector — Certificate chain analysis
• IP Intelligence — Geolocation, ASN, threat reputation (auto-cross-checked against OFAC SDN)
• Vulnerability Scanner — CVE lookup against NVD database
• Crypto Wallet Trace — BTC + ETH lookup (balance, tx history, OFAC SDN sanctions flag)
• OFAC Sanctions Search — query persons, organizations, vessels and aircraft against the US OFAC SDN list

• 25+ live 24/7 news streams from global broadcasters
• Click any news dot on the map to open the live stream
• Feeds from NBC, CBS, ABC, Sky News, Al Jazeera, France 24, NHK, WION, and more

• Public-channel feed scraped from the unauthenticated t.me/s/<channel> web preview — no Bot API token, no MTProto
• Default curated set of 5 channels (EN + RU/UA war reporting), overridable via OSIRIS_TELEGRAM_CHANNELS
• Posts are geoparsed against a multilingual place dictionary (EN + Cyrillic + Arabic) and plotted on the map
• Click any cyan dot to read the post and jump to the original on Telegram

• BTC lookups via blockstream.info (Esplora API, keyless)
• ETH lookups via Blockscout's public ETH instance (eth.blockscout.com, keyless)
• Every lookup is cross-checked against the OFAC SDN sanctioned-address list (mirrored from 0xB10C/ofac-sanctioned-digital-currency-addresses)
• Sanctioned wallets surface a red SANCTIONED — OFAC SDN badge in the RECON panel

• Standalone SANCTIONS tab in the RECON toolkit — full-text search across persons, organisations, vessels and aircraft
• WHOIS and IP-intel routes auto-cross-check registrant / ASN-owner names against the SDN list and surface an inline alert
• Data sourced from OpenSanctions (CC-BY 4.0) — keyless, ~7 MB cached in-memory for 24h

• 13 active conflict/tension zones with severity-coded warning markers
• Active Wars: Ukraine, Gaza, Sudan, Myanmar, DRC, Yemen
• High Tension: Syria, Lebanon, Sahel, Somalia, Red Sea
• Elevated: Taiwan Strait, Korean DMZ

• 75% reduction in edge requests vs initial release
• Aggressive polling relaxation (15-30 min intervals for stable data)
• Static data served from memory (zero external API calls for news feeds)
• layerFetchedRef prevents duplicate API requests

git clone https://github.com/simplifaisoul/osiris.git
cd osiris
npm install
npm run dev

Open http://localhost:3000

git clone https://github.com/simplifaisoul/osiris.git
cd osiris
cp .env.template .env     # optional — configure keys / port
docker compose up -d

Open http://localhost:3000. The image is a multi-stage node:22-alpine standalone build (~220 MB, non-root). The compose file also carries CasaOS app metadata (x-casaos:) for one-click install on CasaOS. See DOCKER.md for the full Docker, CasaOS and API-key guide.

Prebuilt image (GHCR) — skip the build and pull it directly:

docker pull ghcr.io/aiacos/osiris:latest
docker run -d -p 3000:3000 --env-file .env ghcr.io/aiacos/osiris:latest

Custom port — the container always listens on 3000; set OSIRIS_PORT in .env to change the published host port (e.g. OSIRIS_PORT=3005) without editing the compose file.

OSIRIS works partially without any API keys — all core feeds use public, keyless sources. Copy .env.template to .env and set only what you need:

# Published host port (container always listens on 3000). Default: 3000
OSIRIS_PORT=3000

# RECON scanner backend (the only vars the current code reads).
# SCANNER_KEY must match the backend's OSIRIS_KEY — generate with: openssl rand -hex 32
SCANNER_URL=
SCANNER_KEY=

# Optional, for higher rate limits / future sources (see DOCKER.md for signup links)
FIRMS_API_KEY=                # NASA FIRMS  — firms.modaps.eosdis.nasa.gov/api/map_key/
OPENSKY_CLIENT_ID=            # OpenSky OAuth2 (since Mar 2025) — opensky-network.org
OPENSKY_CLIENT_SECRET=
N2YO_API_KEY=                 # N2YO satellites — n2yo.com (Profile → API key)
AIS_API_KEY=                 # aisstream.io maritime

Without SCANNER_URL/SCANNER_KEY the RECON toolkit returns 503; every other layer works out of the box. .env is gitignored — only the template is committed.

MIT — see LICENSE for details.