Build on the
NatusAI OSINT platform

Every data point on the map is rendered through WebGL via MapLibre GL, which is what lets the interface hold thousands of concurrent entities at 60fps. The application is a Next.js app: the map and HUD run in the browser, and each live feed is normalised by a route under /api before it reaches the client.

That boundary is deliberate. Upstream sources disagree about formats, rate limits, and CORS policy, so the API layer absorbs those differences and hands back consistent JSON.

Every read endpoint is a plain GET returning JSON. Nothing below needs authentication — paste any of it into a terminal.

curl -s https://osint.natusai.com/api/flights | jq '.commercial_flights | length'

If you only need magnitudes rather than geometry, /api/stats is the right endpoint to poll — it collapses the heavy feeds into a handful of counters.

curl -s https://osint.natusai.com/api/stats
# { "stats": { "flights": 9241, "sats": 2043, "cctv": 2117,
#              "weather": 58, "nuclear": 191, "incidents": 412 },
#   "timestamp": "2026-07-29T12:00:00Z" }

The OSINT lookups each take one subject, so they compose cleanly in a pipeline:

curl -s "https://osint.natusai.com/api/osint/certs?domain=example.com" | jq -r '.subdomains[]'

NatusAI OSINT requires Node 22+ and access to the private repository. To run it locally:

git clone https://github.com/bogdan-toader/natusai-osint.git
cd natusai-osint
npm ci
npm run dev        # http://localhost:3000

For a production build, or to run the checks:

npm run build && npm start
npm run lint
npm test           # vitest
npm run test:live  # includes tests that hit live upstream feeds

A Dockerfile and docker-compose.yml ship with the repository. The container always listens on port 3000 internally; OSIRIS_PORT controls the host port it is published on.

cp .env.example .env
docker compose up -d

Copy .env.example to .env. Read that file before filling anything in — most of the keys it lists are reserved for future sources and are not consumed by the current code.

Read by the application

Optional — higher rate limits only

FIRMS_API_KEY, OPENSKY_CLIENT_ID, OPENSKY_CLIENT_SECRET, N2YO_API_KEY, AIS_API_KEY. The public keyless feeds are used unless you extend the code to prefer these.

The map fills the viewport and every control floats above it. Panels are toggles rather than destinations, so you can build up exactly the picture you need and drop the rest.

The NatusAI assistant uses your own model key and works two ways. Assist is a conversation (press O): ask in words, typed or spoken, and NatusAI works the map for you. It flies to the place you name, switches the layers on, searches what is live (flights, military aircraft, ships, ports and chokepoints, earthquakes, fires, weather, disaster alerts, news, cameras, satellites), marks what it finds in cyan with the area it searched, and lists it in cards you can click through. It reads the markets, opens panels, and starts forecasts. Each step shows what it did as it does it; choose Navigate, Research or Forecast to steer it, or leave it on Auto.

Forecast is NatusAI OSINT's prediction engine. Ask it a question and it builds a world model from the live feeds (the actors, where they are, how they relate), assembles a deliberately diverse panel of simulated forecasters, and lets them debate over several rounds: each one gives a view, replies to the others, and updates. A report agent then writes a calibrated forecast with its drivers, scenarios, signposts to watch and the strongest dissent. The answer takes the shape the question asks for: a probability for a yes-or-no question, a share for each outcome when it asks which of several will happen, and an estimate with an 80% range when it asks how much. While it thinks, the analysis draws itself on the globe as arcs through the sky; every arc and point can be clicked to open exactly that piece of the research, and the camera follows the run until you take it.

From code, start a run, then follow it over Server-Sent Events or wait for it:

# Start: answers 202 with the run id, a watch link and a run token
curl -s -X POST https://osint.natusai.com/api/oi/runs \
  -H "Content-Type: application/json" \
  -H "X-OI-Provider: openai" \
  -H "X-OI-Key: $OPENAI_API_KEY" \
  -d '{"question": "Will the Fed cut rates at its next meeting?", "depth": "quick"}'

# Wait up to 55 s for the forecast (repeat until status is "done")
curl -s "https://osint.natusai.com/api/oi/runs/RUN_ID?wait=55"

# Or watch it happen
curl -N https://osint.natusai.com/api/oi/runs/RUN_ID/events

The same engine is an MCP server at https://osint.natusai.com/api/mcp (Streamable HTTP). Give an agent the tools oi_predict, oi_get_run, oi_ask, oi_inject and oi_cancel, plus osiris_world_brief and osiris_markets, which are free and need no key. The model key is set once on the connection, as headers, so it never appears in the agent's conversation.

# ~/.hermes/config.yaml
mcp_servers:
  natusai:
    url: "https://osint.natusai.com/api/mcp"
    headers:
      X-OI-Provider: "anthropic"
      X-OI-Key: "sk-ant-..."
      X-OI-Model: "claude-haiku-4-5-20251001"
    timeout: 300

The method follows MiroFish, the open-source swarm-intelligence engine: seed a parallel world from real material, populate it with agents, let them interact while you inject variables, then hand the simulation to a report agent. NatusAI OSINT rebuilds that method natively for its own feeds and globe; no MiroFish code is used. A simulation, not a guarantee.

Press ? at any time inside the application to bring up this list.

In these docs, ⌘K (or /) opens search from anywhere on the page.

All routes live under /api on whatever origin serves the application. Reads are GET, writes are POST with a JSON body. Nothing requires authentication except /api/sdk/ingest and /api/github-webhook. NatusAI runs on a model key you bring, sent in the X-OI-Key header.

Liveness and aggregate counters. Safe to poll from monitoring.

Aircraft, orbital objects, and heliophysics.

Seismic, fire, atmospheric, and orbital-imagery feeds.

Conflict zones, frontlines, event streams, and country-level risk.

News aggregation, live broadcast streams, and financial instruments.

Camera networks, fixed infrastructure, maritime traffic, and tile/stream proxies.

Vulnerability, attack, and malware telemetry.

The lookup tools behind the RECON panel. Every route takes a single subject and returns a normalised result, so they compose well in scripts.

Active scanning, delegated to a separate backend so the web tier never runs scans itself.

Link analysis over entities surfaced elsewhere in the platform.

Gemini-backed correlation over feed data you supply. All three are POST, all three are rate limited to 5 requests per minute per IP.

NatusAI Assist, a model on your own key that works the map in conversation, and swarm-intelligence forecasting on live NatusAI OSINT intelligence: a simulated panel of AI forecasters debates a question over rounds, and a report agent writes a calibrated forecast. Your model key is sent in headers and never stored. Also served as an MCP server at /api/mcp; see NatusAI guide.

Push entities from an external platform into the Common Operating Picture, and stream the merged picture back out.

Inbound hooks from external services.