Real-time OSINT platform with an AI agent harness
Horus
Horus is a real-time OSINT and situational-awareness platform: a live 3D globe that fuses aircraft, ships, satellites, earthquakes, disasters and sanctions lists into one picture, plus an LLM agent harness that can investigate that picture and act on it, safely.
Private beta; happy to give a live walkthrough.
The challenge
Live public feeds are noisy, overlapping and sometimes spoofed. Turning eight of them into one trustworthy picture means resolving the same entity across sources and scoring how much to believe each signal, continuously, as data streams in.
On top of that, an AI agent that can change things is only useful if it can't be talked into doing damage.
Key decisions
- 01
Fusion and entity resolution
ADS-B aircraft, AIS ships, satellite TLEs, USGS/EMSC seismic data, GDACS disasters and sanctions lists, resolved across sources into an entity graph with alerting and time-scrubbable replay. 87 REST/SSE endpoints over a 32-table multi-tenant schema.
- 02
Streaming analytics
Incremental spatial/temporal co-travel detection at roughly O(k) per observation that mints graph edges live, cross-feed spoofing detection, and a deterministic 0–100 reliability score for every signal.
- 03
An agent harness designed from scratch
28 typed, schema-validated tools; mutating actions gated by user confirmation and audit-logged; parallel tool execution; sub-agent orchestration; three-layer memory with context compaction; pluggable LLM providers including local Ollama and bring-your-own-key endpoints.
- 04
Hardened like it will be attacked
Google/X OAuth with PKCE, four-role RBAC, per-feature token budgets with atomic settlement, SSRF guards, two red-team passes and a 328-case agent regression suite (56 adversarial cases), all deployed behind Docker, Caddy and a Cloudflare Tunnel with zero inbound ports.
Results
- ~41k
- lines, full stack, solo
- 8+
- live feeds fused into one picture
- 28
- typed agent tools
- 328
- agent regression cases
- 355 rps
- load-tested, p99 311 ms, zero errors
- 0
- inbound ports open in production
