Global situational snapshot — the cheap first call to orient.

Returns total aircraft (airborne/ground, by category), GNSS-degraded count, active emergency squawks, the worst GPS-jamming cells worldwide, tracked vessel counts by category, and recent fusion-alert counts. A few hundred tokens describing the whole planet.

detail='short' (default) trims the jamming/vessel/alert samples to their top few; detail='long' returns the full situation bundle.

Load a region PRIMARY and return a full intel bundle for it in one call.

This is the headline tool. It triggers a DEDICATED, always-fresh fetch for just this area (bypassing global rate limits) and registers it for ongoing priority refresh. The bundle contains: fresh aircraft summary + sample, aircraft-density grid, GPS-jamming assessment, vessels, and fused anomalies (emergencies, jamming hotspots, dark vessels, alerts) with a threat level.

Args: lat, lon: centre of the area of interest. Required unless polygon is given, in which case they are ignored. radius_nm: radius in nautical miles (1–250; default 200). label: optional human name for the AOI (e.g. "Kaliningrad"). cell_deg: density grid cell size in degrees (0.1–10; default 1.0). polygon: optional irregular region as ONE ring of [lon, lat] pairs (longitude FIRST; 3–500 vertices, closed or open; no holes, no antimeridian crossing). Overrides lat/lon/radius_nm: its bounding circle (max 250 nm, else polygon_truncated) is loaded PRIMARY and every record outside the ring is dropped. Grid cells and jamming hexes are kept by centre point, so use a small cell_deg for a small ring. A total the capped samples cannot give for the ring comes back as _in_circle (the bounding circle's figure).

Aircraft density over an area as a grid of cells (count, by category, GNSS-degraded per cell) plus totals, peak cell, and in-area vessel count.

Give either a centre (lat, lon [, radius_nm]) or an explicit bbox (min_lon, min_lat, max_lon, max_lat). cell_deg sets grid resolution.

GPS/GNSS jamming assessment (GPSJam method: ADS-B NACp<8 / NIC<7 binned into 1° cells). Returns flagged cells ranked by severity, counts of high/medium cells, and a sample of affected aircraft. Omit all coordinates for a global view; otherwise pass a centre or a bbox to scope it.

Filtered aircraft query against the live snapshot. Returns matched_total

• a capped list of compact records.

category ∈ airliner|private|helicopter|glider|military|emergency. Combine with area (centre or bbox), squawk, callsign_contains, altitude band (metres), emergency / gnss_degraded / on_ground booleans. limit ≤200.

Look up one aircraft by ICAO24 hex (exact) or callsign (substring). Returns its current state, registration, an integrity/threat assessment, and the latest server-held fix.

Vessels (AIS) in an area, classified (cargo/tanker/fishing/passenger/ military/sailing/pleasure/tug). dark_only=True returns only dark-vessel candidates (moving with no static identity). Scoped by centre or bbox.

Fused anomaly report for an area (or global if no coords): emergency aircraft, GPS-jamming hotspots, dark-vessel candidates, recent fusion alerts, plus a triage threat_level (low|elevated|high) and score.

Cross-domain INCIDENT brief — the headline analytic tool.

Fuses the raw layers into ranked, cited INCIDENTS instead of returning signals you have to correlate yourself. An incident is a CONVERGENCE: signals within link_km across >=2 domains (GPS-jamming, dark/AIS-off vessels, military air, AIS gaps, emergencies, geocoded events, quakes) — or a single critical/high signal. Each incident carries a rule-based narrative, a threat_level, the contributing evidence (with IDs), and recommended follow-up queries. Omit coordinates for a global brief; pass a centre+radius or bbox to scope it. Start here, then drill into an incident's centroid with query_vessels / gps_jamming / deep_analyze.

Denial & deception — "am I being fed?". Flags MANIPULATED tracks distinct from jamming: AIS duplicate-MMSI (one identity, two hulls) and impossible teleports; ADS-B GPS spoofing (many aircraft snapped to one false position) and kinematic position-injection. Run before trusting a feed in a contested area. Omit coords for global.

Estimate a GPS jammer/spoofer LOCATION from the degraded-ADS-B footprint (severity-weighted centroid + CEP + confidence). Turns "jamming somewhere here" into "emitter ~here ±N km". Footprint-centroid estimate (~tens of km), not RF direction-finding — stated in the response. Scope with lat/lon.

Is this normal? Current vessel / dark-vessel / jamming / military counts z-scored against a rolling baseline, with anomalies called out (e.g. "dark vessels +5σ", "traffic -3σ"). Global uses the background sampler; polling an AOI repeatedly builds that area's baseline. Distinguishes a real shift from a normal day.

Standing watch — what CHANGED since the last check, not the full picture.

Returns incidents that are NEW, ESCALATED, DE-ESCALATED, or RESOLVED. Global (no coords) reflects the background watch loop (recomputed ~every 60s); an AOI (lat/lon) diffs against YOUR previous whats_changed call for that area, so you can poll one region and be told only what moved. Use this to monitor instead of re-reading the whole brief each time.

Timeline of how each incident built up over the recent window — per incident, a compact series of [time, threat_level, score] points. Reveals sequence (e.g. jamming first, then dark vessels, then a reported event). Global uses the background watch history; an AOI uses your prior watch calls.

The full window can hold many incidents; this returns the limit most active ones (default 25, alias max_incidents) with each series downsampled to its threat-level transitions, and reports incident_count / returned / truncated so you know if more exist. Raise limit or narrow with lat/lon/hours to drill in.

Pattern-of-life dossier for one vessel (MMSI): recent track, AIS gaps, derived speed profile (loiter / transit / loiter-then-dash), area covered, which live incidents it appears in, and a behaviour assessment. The track is the store's ~1h retention window.

Pattern-of-life dossier for one aircraft (ICAO24 hex or callsign): recent track, gaps, derived speed profile, GNSS-integrity, emergency/military flags, and which live incidents it appears in.

List the priority areas currently loaded PRIMARY (with fetch stats and whether each is served by a dedicated fetch or the degraded snapshot fallback).

Which feeds are always-on vs key-gated, and the configured Ollama host/model. Use to explain coverage gaps (e.g. fires need a FIRMS key).

GDACS severity-scored global disasters (earthquake/cyclone/flood/volcano/ drought/wildfire), each Green/Orange/Red by modelled impact.

Active wildfire burn-area polygons (NIFC/WFIGS) — the AREA behind FIRMS hotspot points, with incident name + size in acres.

Active tropical cyclones (NHC) with center fix, classification, intensity and pressure.

Smithsonian GVP Holocene volcanoes — location, type, elevation, last eruption year.

Recent Safecast crowd radiation measurements (value + unit + location) — a nuclear-incident detection layer.

ReliefWeb active humanitarian disasters, geocoded to the affected country.

Air quality (US AQI + PM2.5/PM10) sampled across major world cities — a proxy for industrial activity, smoke drift, and chemical release.

NDBC marine buoy observations — wave height, wind, pressure, water temp.

Vessel congestion at named straits (Hormuz/Suez/Malacca/Bosphorus/…), derived live from the AIS union: vessel + stationary counts per chokepoint.

SWPC space weather — solar X-ray flares, active alerts, and the auroral oval. The causal layer under GPS/HF degradation.

WRI global power plants (≥200 MW) — name, fuel, capacity, country. Static energy-infra targets to correlate strikes/outages against.

AIRMET/SIGMET hazard polygons (turbulence, icing, IFR, volcanic ash, convective) constraining the aircraft layer.

Official country-level travel advisories pooled from US State, UK FCDO, and Australia Smartraveller — each country's highest reported level.

UN OCHA HAPI country-level IDP and refugee figures, latest reporting period per country.

FAA National Airspace System ground stops, ground delays, arrival/ departure delays, and airport closures, as points at the affected airport.

Temperature/precipitation anomalies (vs. a 5-year same-window baseline) over conflict-dense country centroids.

Batched keyless market quote snapshot: indices, commodities, fx, crypto.

Composite market-stress score from equity drawdown, gold/oil moves, USD flight-to-safety, and BTC drawdown.

Earthquakes (USGS) within radius_km of a point (GET /api/eq).

lat, lon, and radius_km must ALL be given together — the route 422s on a partial set rather than silently falling back to the unfiltered global feed (agent-safe: pass all three or none). range is 'hour'|'day' (default)|'week'|'month'. For a severity-scored global disaster view instead, use disaster_alerts().

Historical position track for ONE entity (GET /api/history/track).

id is 'aircraft:' / 'vessel:', or a bare id whose shape is unambiguous (6-char ICAO24 hex or 9-digit MMSI) — the route infers the kind from it. from_ts/to_ts are unix seconds (default: the last hour). A id the route can't resolve returns its 422 message as-is (e.g. ambiguous shape — pass a 'kind:id' prefix).

Create a standing watch rule (POST /api/alerts/rules).

A rule needs a gate: either an identity pin (icao24/mmsi/callsign — follows that one entity globally, no AOI required) or a complete AOI (lat, lon; radius_nm defaults to 50 nm if omitted). kinds filters which signal kinds fire it — jamming/dark_vessel/military_air/military_vessel/incident/quake/ fire/ais_gap/rendezvous/loiter (omit for all). channel is 'inapp'|'discord'|'webhook' ('discord'/'webhook' require sink_url). The route validates and 400/422s on a bad gate, channel, sink_url, or kind — this wrapper does not re-validate, it passes the error through.

List your standing watch rules (GET /api/alerts/rules).

Delete a standing watch rule by id (DELETE /api/alerts/rules/{rule_id}).

Queue a governed action for the operator to approve (POST /api/actions/proposals).

This does NOT run the action. name is one of the registered actions (GET /api/actions lists them and their params): flag_entity, promote_incident, nominate_target, add_watch, writeback. params is that action's own param object — validated here, so a malformed proposal is rejected now rather than at approval time. confidence (0-1) is your own reported confidence and is recorded with the proposal.

writeback writes a record OUT to a system the operator runs (an allow-listed HTTP endpoint, or a Foundry sql connection) and is operator-only: send dry_run: true first, which validates the target and the SSRF policy without sending anything.

Multi-user deployments: this server authenticates with an INTERNAL token that is deliberately never a user (apps/api/CLAUDE.md, Auth), so on a Supabase deployment these four tools answer 401 by design — a write-back has to be attributable to a person, and the internal token is not one. They are for the single-operator box, where the operator IS the one user.

Pending action proposals awaiting operator approval, oldest first (GET /api/actions/proposals). 401 on a multi-user deployment by design — see propose_action.

Approve and EXECUTE a queued proposal (POST /api/actions/proposals/{id}/approve).

Only call this when the operator has told you to. The receipt carries the audit row the execution wrote. 404 for an unknown or expired proposal (the queue has a 15-minute TTL); 403 when the action is operator-only and the caller is not the operator; 401 on a multi-user deployment by design — see propose_action.

Drop a queued proposal without executing it (POST /api/actions/proposals/{id}/reject). 401 on a multi-user deployment by design — see propose_action.

Have a reasoning model reason deeply over the live intel.

Gathers the relevant data (global situation, plus a focused area bundle + jamming + anomalies when lat/lon given) and feeds it to a real reasoning model — DeepSeek (deepseek-reasoner) when configured, else a local Ollama model. Heavy reasoning runs off-context; only the conclusion enters the agent's context. Falls back to returning the raw structured data (analysis=null) if no LLM backend is reachable.

Args: question: what to analyse (e.g. "Is there coordinated GPS jamming near the Baltic, and which aircraft are affected?"). lat, lon, radius_nm: optional area to focus on (loaded PRIMARY). model: optional Ollama model override used only on the Ollama fallback. tier: reason (deepseek-reasoner, default — judgement) or fast (deepseek-chat — quicker, shallower).

Cross-source, debiased world-news intelligence.

Scrapes ~12 outlets (BBC, Reuters, AP, Al Jazeera, Guardian, CNN, Fox, …), then a reasoning model strips bias/propaganda and separates VERIFIED FACTS (corroborated by ≥2 independent outlets) from ATTRIBUTED CLAIMS and rhetoric. A leader promising "the war will end soon" is flagged as rhetoric, never reported as fact. Returns events with neutral_summary, verified_facts, attributed_claims, bias_flags, propaganda_techniques, rhetoric_flags and a confidence. May take ~30s when the cache is cold (it reasons over the feed).

Adjudicate one free-text claim against current world-news headlines.

Returns {verdict: true|false|misleading|unverified, reasoning, supporting_sources, confidence}. Use it to sanity-check a statement before treating it as fact.

Latest assembled morning brief: top story per category plus a short synthesis paragraph tying the leads together. Built on a ~20h cadence by the background news refresher, not on-demand — use news_analysis or the edition route for the freshest per-story detail.

Building imagery for a location at two dates — set time + place directly.

Give a location (lat/lon + radius_km, OR an explicit min/max bbox) and a before + after date (YYYY-MM-DD). Returns what imagery is available for each date WITHOUT downloading: Maxar Open Data VHR (~0.3-0.5 m, event-gated — only where a disaster/conflict event covers the AOI) and Sentinel (10 m, global, any date). best_source says which to use. Reconstruction downloads the scenes to a temp dir on demand and discards them — nothing is stored.

Args: before, after: dates as YYYY-MM-DD. lat, lon, radius_km: centre + radius (km) of the AOI. min_lon/min_lat/max_lon/max_lat: explicit bbox (overrides lat/lon). window_days: ± days around each date to search Maxar (events are sparse).

Named questions answered with a verdict, its rule, and the evidence age.

The one call that returns a CONCLUSION rather than data to interpret. Each answer carries verdict (open / reduced / closed / unknown), threshold (the rule that produced it, in words), data_lag_s (how old the newest evidence is), and stale.

Two contracts worth relaying to a user verbatim rather than paraphrasing: unknown is a real answer and its detail says why we cannot answer yet, and data_lag_s of null means NO EVIDENCE WAS OBSERVED - never "fresh". Report stale alongside any verdict you quote.

Omit question_id to list every registered question.

Which sources are seeing the sky right now, and how much they agree.

Per tier: how many contacts it reported and how many ONLY it reported, plus the share of contacts with two or more independent observers and the confidence rule in force.

The exclusive count is the column that matters. Crowd-sourced ADS-B accepts whatever is uploaded to it, so a contact only one tier can see is not corroborated, and a tier contributing thousands of exclusive contacts is either unique coverage or an unverifiable claim. Say which when you report it, and never present an uncorroborated contact as confirmed.

What changed inside a box between two moments: arrived, departed, stayed.

Answers from OWNED history, so it works for any past window still retained rather than only the present instant. at_a and at_b are epoch seconds (at_b defaults to now); each is widened by window_sec because a stored position is a sample rather than a continuous truth.

recorded: false means nothing was in the archive for that box and window - which is NOT the same as "nothing changed". Do not report an empty archive as a quiet period.

What is configured, what is missing, and the exact line that fixes it.

Use this when a layer looks empty before concluding the world is quiet: a blank layer is far more often an unconfigured optional source than an absence of activity. Every capability listed is optional - the console runs keyless - so a long problems list is not a fault list. Never report a missing optional key as a defect.

Live air-raid alert status across Ukraine's 25 oblasts (alerts.com.ua).

FIRMS fire hotspots within the Ukrainian theater (DeepState).

Live radiation monitoring stations in Ukraine (DeepState, ~565 stations).

Amateur-radio reception reports from PSKReporter, plotted at the transmitter.

Each feature is an emitter that an independent receiving station decoded in the last minutes, carrying callsign, Maidenhead grid, band, mode and SNR. Positions are grid-square CENTRES, so read properties.precision_km before treating one as a location.

Geolocated war-news events from the DeepState map.

Recent satellite downlink observations from the SatNOGS ground station network — real decoded telemetry from space.

Map of active SatNOGS ground stations worldwide.

Known satellite transmitter frequencies from the SatNOGS database. Pass a NORAD catalog ID to filter to one satellite.

Live weather balloon (radiosonde) positions worldwide from SondeHub.

CISA Known Exploited Vulnerabilities catalog — what's actively being exploited in the wild right now.

Shodan InternetDB lookup for one IPv4 address — ports, vulns, hostnames. NO API key needed.

Recent FEMA disaster declarations across US states and territories.

Today's SPC severe weather reports — tornado, wind, and hail events.

Military objects from OpenStreetMap via Overpass API. bbox = south,west,north,east.

USGS MRDS mineral deposit sites inside a bbox.

bbox is REQUIRED for data (lon_min,lat_min,lon_max,lat_max): the whole catalogue is ~300k sites, so with no viewport this answers an empty collection. commodity matches the MRDS CODE ("CU", "AU"), not a name.

Look up a company's Legal Entity Identifier (LEI) via the GLEIF API.

Search US court opinions on CourtListener.

UNHCR refugee/IDP population figures by country.

WorldPop population grid datasets metadata. Filter by ISO3 country.

Search humanitarian datasets on HDX (data.humdata.org).

Live aircraft by ICAO24 hex code (e.g. 'a1b2c3').

Live aircraft by tail/registration number (e.g. 'N12345').

Live aircraft by callsign (e.g. 'UAL123').

Live aircraft by ICAO type designator (e.g. 'B738', 'A320').

Aircraft on FAA's Limiting Aircraft Data Displayed (LADD) list.

Aircraft using Privacy ICAO Address (PIA) — randomized hex codes.

FlightRadar24 unauthed search — aircraft, airports, flights.

GDELT DOC 2 API — article-level search across global news.

Scrape recent messages from a Telegram OSINT channel.

Master catalog of all data sources the platform knows about — tile providers, SAR archives, SDR directories, splat sources, streaming endpoints, and more. Filter by category.

Search Sketchfab for downloadable 3D Gaussian Splat models.

ESRI Wayback time-travel manifest — every historical imagery version since 2014.

Microsoft Global Buildings manifest — 1.3 billion footprint polygons, download links per quadkey region.

Map of public KiwiSDR software-defined radio receivers worldwide.

Recent LoRa satellite packets from the tinyGS community network.

Health of the keyless AIS pipeline: vessels per source, the OpenWaters sweep (tiles failed/truncated, whether it completed), fix-age percentiles, and the standing note that keyless AIS is coastal, not open-ocean.

Where keyless AIS actually reaches: a dense 36x72 grid of live-vessel counts in 5 degree cells (row 0 = 90S..85S, col 0 = 180W..175W). A zero cell means no feed reports there, not that the sea is empty. Returned whole; a trimmed grid would be unreadable.

Vessels in a box from the freshness-wins AIS store, freshest first, each with its fix age and every source that reported it. bbox = lon0,lat0,lon1,lat1 (lon0 > lon1 crosses the antimeridian). count is the true number in the box even when the list is trimmed.

Recent keyless Sentinel-1 SAR scenes over a box, for water AIS does not reach. bbox = lon0,lat0,lon1,lat1. By default a SCENE INVENTORY (id, time, footprint, public download URL). detect=True also returns LOCATED radar contacts for a box up to one degree a side, each classified against AIS: 'dark' only where enough nearby AIS makes absence meaningful, otherwise 'unknown'. Read note: it says when detection did not run and why.

Unidentified satellite AIS positions: where ships are in OPEN OCEAN, beyond coastal AIS. Each is a position, a type class and a heading only; upstream publishes no MMSI, name or position age for them, so do not present one as a tracked, identified vessel. bbox = lon0,lat0,lon1,lat1 (optional). count is the true total even when the list is trimmed.