Shadowbroker

Abstract

Open-source intelligence for the global theater. Track everything from the corporate/private jets of the wealthy, and spy satellites, to seismic events in one unified interface. The knowledge is available to all but rarely aggregated in the open, until now.

The Problem

Global telemetry—aircraft transponder data, maritime AIS, satellite orbits, seismic sensors, mesh radio traffic—is public but scattered across dozens of disconnected tools and APIs. Analysts and researchers waste significant time correlating these feeds manually. ShadowBroker aggregates 60+ live sources into a single geospatial interface so that cross-domain correlation happens in one place rather than across a dozen browser tabs.

What This Does

ShadowBroker is a self-hosted OSINT dashboard with a Python backend (backend/main.py) and a desktop shell built on Tauri (desktop-shell/src/index.ts). The backend is organized around a fetcher architecture: backend/services/fetchers/ contains individual modules for flights, satellites, military movements, yachts, trains, news, and more. A correlation engine (backend/services/correlationengine.py) fuses these feeds. Data files like backend/data/militarybases.json and backend/data/planealertdb.json provide static reference layers.

The project also includes a substantial mesh networking subsystem (backend/services/mesh/) implementing encrypted peer-to-peer messaging with wormhole-style identities, prekeys, and ratchets. This is experimental and explicitly labeled as a testnet. The desktop shell wraps the backend in a native application with handlers for settings, updates, and wormhole operations.

How To Use It

Setup: The repo includes a Makefile, Dockerfiles, and both package.json (npm) and pyproject.toml (pip/uv). The Makefile likely orchestrates the full build. A compose.sh script suggests docker-compose orchestration.

Configuration: Copy .env.example to .env and populate API keys—notably SHODANAPIKEY for the Shodan connector. The backend has its own backend/.env.example.

Running it: The backend entry point is backend/main.py (likely FastAPI/uvicorn). The desktop shell entry is desktop-shell/src/index.ts. Without the README's actual commands, the safest path is:

Backend (Python)

cd backend pip install -r requirements.txt # or uv sync with pyproject.toml uvicorn main:app --reload

Desktop shell (requires Rust toolchain for Tauri)

cd desktop-shell npm install npm run tauri dev

The exact commands are not documented in the available files—the README excerpt doesn't include setup instructions.

Real-World Use

A researcher monitoring geopolitical flashpoints could run ShadowBroker against a VPS, configure newsfeeds.json for regional sources, and let the correlation engine surface anomalies—e.g., a military tanker circling near a coast while GPS jamming zones appear in the same area. The right-click dossier feature (backend/services/regiondossier.py) provides immediate country context without leaving the map.

Code Health & Issues

High - Possible secrets in repo: backend/scripts/scan-secrets.sh exists, which suggests the team is aware of secret leakage risk, but its presence doesn't confirm clean history. Verify before deploying. Med - Over-engineering risk: The mesh subsystem (backend/services/mesh/, ~30 modules) is substantial for a project whose core value is data aggregation. This adds significant attack surface and maintenance burden. Med - Test coverage imbalance: 57 test files exist, but most target the mesh subsystem. Core fetchers like flights.py, satellites.py, and military.py appear to have no dedicated tests. Med - Missing license: A LICENSE file is listed but no license type is confirmed. This blocks commercial use without legal review. Low - CI/CD present: .github/workflows/ci.yml and docker-publish.yml indicate automated testing and container publishing are configured.

The Bottom Line

ShadowBroker delivers a genuinely impressive aggregation of public intelligence sources with a clean fetcher architecture and a working desktop shell. The mesh networking and wormhole subsystems are ambitious but experimental—treat them as such. The uneven test coverage and unresolved licensing are the main blockers for production adoption. Suited for security researchers and OSINT practitioners willing to self-host and audit the code; not yet a turnkey product.