Maritimeint

pip install cognis-maritimeint
maritimeint locate demos/ais_sample.json   # → prioritized grey-fleet watchlist in seconds

🆕 New in v0.9 — track-interaction & vessel-behaviour intelligence

	What changed	Try it
🎯	CPA / TCPA close-quarters — Closest Point of Approach + Time to CPA for every vessel pair; flags converging tracks projected to pass inside a danger radius (collision avoidance / standoff-perimeter breach). Pure relative-motion math — separation only, never an intercept	maritimeint close-quarters ais.json
🛰️	Shadowing — one vessel persistently trailing another at a held standoff on a matched course (surveillance / interdiction / escort-precursor signature — distinct from a rendezvous)	maritimeint shadowing ais.json
🚢	Convoy / co-movement — clusters of vessels moving together (tight grouping + matched heading & speed across epochs): escort groups & shepherded grey-fleet flotillas single-vessel detection misses	maritimeint convoy ais.json
🆘	Drift / not-under-command — near-zero speed with erratic heading swing → disabled / dragging / possible-distress safety early-warning	maritimeint drift ais.json
🧩	encounters mode + folded into analyze — all four run in one pass, score the risk ranking, and export to GeoJSON/KML/STIX/CSV unchanged	maritimeint encounters ais.json

All four are pure-stdlib, additive layers — see the encounters guide and demos/05-encounters.

New in v0.8 — spatial intelligence, dark-STS & live 2026 sources

	What changed	Try it
🗺️	Zone intelligence (geofencing) — define EEZs, sanctioned ports & exclusion / war-risk zones as GeoJSON; every finding is tagged with where it happened	maritimeint zones ais.json --zones zones.geojson
🌑	Dark-rendezvous correlation — the real dark-STS move: one tanker kills AIS while another loiters at the spot (the case plain rendezvous can't see)	maritimeint dark-rendezvous ais.json
📡	GPS spoofing & jamming — flags circling spoof tracks and jamming hotspots where many vessels snap to one synthetic position	maritimeint gps ais.json
⚓	Port-call sequencing — reconstructs each vessel's itinerary and flags sanctioned-port legs	maritimeint port-calls ais.json --itinerary
🔴	3× more sources + real-time scraping — source catalog tripled with live 2026 feeds, plus a new keyless livesearch module that pulls current OSINT at runtime (Google News · RSS/Atom · DuckDuckGo), no API keys	python -m livesearch "sanctioned tanker" --when 7d

All four detectors are pure-stdlib, additive layers folded into analyze / locate — see the v0.8 walkthrough and demos/04-dark-sts-zones.

Watch the walkthrough

A full narrated tour — setup, the tool in action, and every demo scenario:

Watch the maritimeint walkthrough

▶ Watch the walkthrough (MP4)

🔎 Example output

Real, reproducible output from the tool — runs offline:

$ maritimeint --version
maritimeint 0.9.0

$ maritimeint --help
usage: maritimeint [-h] [--version] [--format {table,json}]
                   {analyze,gaps,jumps,loiter,spoof,rendezvous,dark-rendezvous,gps,close-quarters,shadowing,convoy,drift,encounters,zones,port-calls,locate,vision,export,menu,addins,import-ofac,feeds,import-sanctions,fetch-ais} ...

AIS vessel tracking & sanctions-evasion anomaly detection.

positional arguments:
  {analyze,gaps,jumps,loiter,spoof,rendezvous,dark-rendezvous,gps,close-quarters,shadowing,convoy,drift,encounters,zones,port-calls,locate,vision,export,menu,addins,import-ofac,feeds,import-sanctions,fetch-ais}
    analyze             run full detector suite + risk ranking
    gaps                detect AIS reporting gaps (going dark)
    jumps               detect implausible position jumps
    loiter              detect loitering / STS staging
    spoof               detect spoofing / identity conflicts
    rendezvous          detect vessel-to-vessel meetings
    dark-rendezvous     correlate a vessel going dark with another loitering
                        at the spot
    gps                 detect GPS spoofing (circling) / jamming hotspots
    close-quarters      CPA/TCPA: vessel pairs projected to pass dangerously
                        close
    shadowing           detect one vessel persistently trailing another at
                        standoff
    convoy              detect groups of vessels moving together (co-movement)
    drift               detect adrift / not-under-command vessels
                        (safety/distress)
    encounters          run the full track-interaction suite (CPA + shadow +
                        convoy + drift)
    zones               detect zone/geofence entries, exits and dwell
    port-calls          infer port calls + sequence itineraries (risk-tagged)
   

Blocks above are real maritimeint output — reproduce them from a clone.

Sample result format (illustrative values — run on your own data for real findings):

{
"analyze": [
  {
    "id": "123456",
    "risk_rank": 3,
    "events": [
      {
        "type": "gaps",
        "start": "2022-01-01T00:00:00Z",
        "end": "2022-01-02T12:00:00Z"
      },
      {
        "type": "jumps",
        "start": "2022-01-03T14:00:00Z",
        "end": "2022-01-04T16:00:00Z"
      }
    ]
  }
]
}

Contents

• Why maritimeint? · Features · What's new in v0.8 · Quick start · Example · Architecture · Demos · AI stack · How it compares · Integrations · Install anywhere · Related · Contributing

Why maritimeint?

AIS vessel tracking & sanctions-evasion anomaly detection — without standing up heavyweight infrastructure.

maritimeint is single-purpose, scriptable, and self-hostable: point it at a target, get prioritized results in the format your workflow already speaks (table · JSON · SARIF), gate CI on it, and let agents drive it over MCP.

Features

• ✅ Parse Messages
• ✅ Load Messages
• ✅ Haversine Nm
• ✅ Detect Gaps
• ✅ Detect Speed Jumps
• ✅ Detect Loitering
• ✅ Detect Spoofing
• ✅ Detect Rendezvous (ship-to-ship transfer signature)
• ✅ CPA / TCPA close-quarters v0.9 — Closest Point of Approach + Time to CPA per vessel pair; flags converging tracks projected to pass inside a danger radius (the bridge collision-avoidance primitive, applied to AIS history for safety & force-protection standoff monitoring — separation only, no intercept/targeting)
• ✅ Shadowing v0.9 — one vessel persistently trailing another at a held standoff on a matched course; reports leader/follower roles (surveillance / interdiction / escort-precursor signature, distinct from a rendezvous)
• ✅ Convoy / co-movement clustering v0.9 — groups of vessels moving as one formation (proximity + matched heading & speed across epochs): escort groups & shepherded flotillas single-vessel detection treats as unrelated
• ✅ Drift / not-under-command v0.9 — near-zero speed with erratic heading swing → disabled / anchor-dragging / possible-distress safety early-warning
• ✅ encounters mode v0.9 — runs all four interaction/behaviour detectors in one pass; also folded into analyze so they score the risk ranking and flow through every exporter (guide)
• ✅ Dark-rendezvous correlation v0.8 — one vessel goes dark while another loiters at the vanish point (the dark-STS signature rendezvous misses, because only one party is broadcasting)
• ✅ Zone intelligence / geofencing v0.8 — GeoJSON or native polygons + great-circle "circle" zones (EEZs · sanctioned ports · exclusion / war-risk); entry/exit/dwell events + every positional finding tagged with its zone
• ✅ GPS spoofing & jamming v0.8 — circle_spoof (a track populating the whole compass around a tight centroid) + gps_jamming (many distinct MMSIs pinned to one synthetic position)
• ✅ Port-call sequencing v0.8 — dwell-based port calls from a built-in (or custom) registry, sequenced into per-vessel itineraries with sanctioned-port legs flagged
• ✅ Live 2026 sources + real-time scraping v0.8 — livesearch.py: keyless, stdlib, real-time web-search + RSS/Atom ingestion (web_search · fetch_feed · ddg_search · harvest); the SOURCES.md catalog now carries 3× the feeds, queries & APIs
• ✅ Native intel export v0.9 — turn any analysis into GeoJSON (Leaflet/Mapbox/QGIS/kepler.gl), KML (Google Earth / marine charts), STIX 2.1 bundle (threat-intel platforms) or CSV — zero dependencies: maritimeint export ais.json --to geojson
• ✅ LocateAnything watchlist — one call → prioritized, explained grey-fleet watchlist (HIGH/MEDIUM/LOW + plain-language reasons)
• ✅ Sanctions cross-reference — match tracked vessels to an OFAC/EU/OFSI-style list by MMSI / IMO / name
• ✅ Composable AI add-ins — optional vision (imagery triage) + reasoning (narrative assessment) that stack onto the stdlib core, via the Cognis fleet / edgemesh; hardware/availability-gated (off if no backend)
• ✅ Multi-level interactive menu (maritimeint menu)
• ✅ Runs on Linux/macOS/Windows · Docker · devcontainer
• ✅ Ports in Python, JavaScript, Go, and Rust (ports/)

Grey-fleet watchlist + AI add-ins

maritimeint locate demos/ais_sample.json --sanctions demos/sanctions_sample.json
#  [HIGH ] 210111000 NEPTUNE STAR [SANCTIONED]  score=12
#        - ON SANCTIONS LIST (...)   - AIS gap 9h (going dark)
#        - rendezvous 90min, 0.008nm (possible ship-to-ship transfer)
maritimeint addins                 # which AI add-ins are reachable right now
maritimeint locate <ais.json> --ai # augment with the reasoning model if a backend is up
maritimeint menu                   # interactive, multi-level

# point the add-ins at a LIVE edgemesh gateway (or any OpenAI-compatible /v1):
maritimeint locate <ais.json> --endpoint http://<edgemesh-host>:8780 --model <id>
maritimeint vision https://.../sentinel1_scene.png --endpoint http://<edgemesh-host>:8780 --model <vl-model>

Real sanctions data — every major list, one format

Screen against actual government designations, not a sample. Pull from any single source, or --source all to fetch + merge every public feed (de-duplicated by IMO → MMSI → name, with each vessel's source lists unioned):

maritimeint import-sanctions --source all --out sanctions.json     # OFAC + OpenSanctions, merged
maritimeint import-sanctions --source opensanctions                # aggregates OFAC/EU/UK/UN
maritimeint import-sanctions --source ofsi --from-file ConList.csv # UK OFSI (downloaded)
maritimeint import-sanctions --source eu   --from-file eu_list.xml # EU consolidated (downloaded)
maritimeint locate fleet.csv --sanctions sanctions.json --fail-on high

--source	Authority	Format	Fetch
ofac	US Treasury OFAC SDN	CSV	live URL
opensanctions	OpenSanctions (OFAC/EU/UK/UN)	FtM JSONL	live URL
ofsi	UK HM Treasury OFSI	CSV	--from-file
eu	EU consolidated list	XML	--from-file
all	OFAC + OpenSanctions, merged	—	live URLs

import-ofac (OFAC-only) remains for back-compat. OFSI/EU publish at drifting / gated endpoints, so those parse a list you download. See SOURCES.md.

Edge / air-gap data feeds — OFAC SDN that works disconnected

maritimeint bundles a stdlib-only data-feed ingestion engine (maritimeint/datafeeds.py + catalog data_feeds_2026.json) so the real OFAC sanctions list keeps working on shipboard / disconnected / air-gapped edge gear: keyless HTTPS fetch → on-disk cache → offline re-serve → sneakernet snapshot.

The feeds command exposes the maritime-relevant slice of the shared Cognis feed catalog (just the OFAC SDN list for this tool):

maritimeint feeds list                              # relevant feeds + cache freshness
maritimeint feeds update ofac-sdn                   # fetch + cache (connected box)
maritimeint feeds get ofac-sdn --offline            # re-serve from cache, no network

Feed id	Authority	Source URL	Format
ofac-sdn	US Treasury OFAC	https://www.treasury.gov/ofac/downloads/sdn.csv	CSV

Real enrichment. The cached SDN list feeds straight into vessel screening — designated vessels (OFAC records IMO/MMSI in the Remarks field) become the --sanctions list, and the whole path runs offline:

maritimeint import-ofac --from-feed --offline --out ofac.json   # SDN from cache, no network
maritimeint locate ais.json --sanctions ofac.json               # flag sanctioned vessels

Air-gap workflow (sneakernet). Snapshot the cache on a connected box, carry it into the enclave, and every screen runs with zero network:

# connected box
maritimeint feeds update ofac-sdn
maritimeint feeds snapshot-export feeds.tar.gz
# inside the air gap (after transfer)
maritimeint feeds snapshot-import feeds.tar.gz
maritimeint import-ofac --from-feed --offline --out ofac.json

The cache location is COGNIS_FEEDS_CACHE (default ~/.cache/cognis-feeds). See demos/feeds_offline_demo.sh for the full offline run. Tests pin COGNIS_FEEDS_CACHE at a committed fixture and use offline=True, so CI is green with no network.

Live AIS in, watchlist out

Normalize any AIS provider's export (or pull a live bounding box) into the detectors — field names are aliased automatically and unix timestamps become ISO UTC:

maritimeint fetch-ais --source file --from-file provider_export.csv --out ais.json
maritimeint fetch-ais --source aishub --username YOU --latmin 24 --latmax 27 --lonmin 54 --lonmax 57
maritimeint analyze ais.json                                       # then run the detectors

(aisstream.io is a websocket stream — collect PositionReport messages to JSON, then fetch-ais --source file.)

The detection core is pure stdlib and always works. Add-ins stack extra capability when a model backend is reachable — point them at an edgemesh gateway (which unifies uncensored-fleet, cognis-code, and a vision/VL backend behind one /v1), or at those fleet endpoints directly. If nothing's up, add-ins stay off and the core watchlist still runs. Detection/situational-awareness only — see the disclaimer.

Quick start

pip install cognis-maritimeint
maritimeint --version
maritimeint analyze demos/ais_sample.json            # full detector suite + risk ranking
maritimeint locate demos/ais_sample.json             # prioritized, explained watchlist
maritimeint locate demos/ais_sample.csv              # CSV in too (real AIS-provider exports)
maritimeint --format json locate demos/ais_sample.json   # machine-readable
maritimeint locate fleet.csv --sanctions ofac.json --fail-on high   # compliance/CI gate (exit≠0)
maritimeint export demos/ais_sample.json --to geojson -o findings.geojson   # map-ready
maritimeint menu                                     # interactive multi-level menu

Export & share the intelligence

maritimeint export runs the full detector suite and serializes the findings into the format your workflow needs — no extra dependencies:

maritimeint export ais.json --to geojson -o findings.geojson  # Leaflet/Mapbox/QGIS/kepler.gl
maritimeint export ais.json --to kml     -o findings.kml      # Google Earth / marine charts
maritimeint export ais.json --to stix    -o findings.json     # STIX 2.1 bundle for TIPs
maritimeint export ais.json --to csv     -o findings.csv      # spreadsheets / notebooks
maritimeint export ais.json --to geojson --zones eez.geojson  # tag findings with zones first

GeoJSON/KML use [lon, lat] ordering and render every positional finding as a point or track; the STIX bundle emits one deterministic-id indicator per finding (ATT&CK-friendly, x_maritime custom props preserved). For pushing a watchlist to MISP/Splunk/Elastic/Slack, see locate --emit (via cognis-connect).

Works with whatever model backend you run — set MARITIMEINT_ENDPOINT (or OPENAI_BASE_URL) to your fleet/gateway, or let it auto-discover one on the common local ports. No backend? The stdlib detection core still runs; AI add-ins just stay off.

Example

$ maritimeint locate demos/ais_sample.json --sanctions demos/sanctions_sample.json
MARITIMEINT watchlist (3 vessels, highest risk first):
  [HIGH  ] 210111000 NEPTUNE STAR [SANCTIONED]  score=12
        - ON SANCTIONS LIST (SAMPLE-EO14024)
        - AIS gap 9.0h (going dark)
        - rendezvous 90.0min, min 0.008nm (possible ship-to-ship transfer)
  [MEDIUM] 210444000 GHOST RUNNER  score=3
        - implausible 462.2kn position jump (possible spoofing)

v0.8 — spatial intelligence, dark-STS & live sources

Four additive, pure-stdlib detection layers (all folded into analyze / locate, so they enrich the watchlist automatically) plus a keyless real-time source feed. Run the whole story end-to-end with demos/04-dark-sts-zones:

# full suite + spatial context: every finding tagged with the zone it falls in
maritimeint --format json analyze demos/04-dark-sts-zones/feed.json \
    --zones demos/04-dark-sts-zones/zones.geojson

maritimeint dark-rendezvous demos/04-dark-sts-zones/feed.json   # dark-STS correlation
maritimeint gps             demos/04-dark-sts-zones/feed.json   # spoofing / jamming
maritimeint zones           demos/04-dark-sts-zones/feed.json --zones demos/04-dark-sts-zones/zones.geojson
maritimeint port-calls      demos/04-dark-sts-zones/feed.json --itinerary   # Kharg (sanctioned) → Singapore

🗺️ Zone intelligence (zones.py) — define areas an analyst cares about as GeoJSON (FeatureCollection / Feature / geometry) or the native form, with polygon (ray-cast point-in-polygon) or circle (center + radius_nm) geometry. --zones on analyze/locate annotates every positional finding with the zone(s) it falls in; the zones command reports entry/exit + dwell, severity-weighted by kind (sanctioned_port / exclusion / war_risk → high).

🌑 Dark-rendezvous (detect_dark_rendezvous) — rendezvous needs both vessels broadcasting. This catches the evasion that matters: vessel A switches off AIS, and vessel B keeps reporting at A's vanish / reappear point during the dark window — the lightering ship sitting on the spot. Returns the pair, the closest approach, and the gap.

📡 GPS spoofing & jamming (detect_gps_anomalies) — two artifacts: circle_spoof measures angular coverage around the track centroid (a spoofed "circling" track populates the whole compass within a tiny radius; a straight passage never does), and gps_jamming finds many distinct MMSIs snapped to one position within a short window (the classic jamming hotspot).

⚓ Port-call sequencing (ports.py) — infers dwell-based calls from a built-in registry (includes Kharg Island, Bandar Abbas, Primorsk, Ust-Luga, Nakhodka, Tartus, Nampo…) or your own (--ports), then --itinerary sequences each vessel's calls and flags the load-dirty → sell-clean legs that touch a sanctioned / high-risk port.

🔴 Live 2026 sources + real-time scraping (livesearch.py) — keyless, zero-dependency real-time ingestion so monitoring stays current, not static:

python -m livesearch "shadow fleet sanctioned tanker" --when 7d   # live Google-News RSS search
python -m livesearch --feed https://gcaptain.com/feed/ --json     # any RSS/Atom feed
python -c "import livesearch as ls; print(len(ls.harvest([{'query':'OFAC sanctioned vessel'}, \
    'https://gcaptain.com/feed/'], since_days=14)))"               # mixed harvest, deduped, 2026-only

web_search() uses Google News RSS as a keyless search backend, fetch_feed() parses any RSS 2.0 / Atom feed, ddg_search() scrapes DuckDuckGo HTML, and harvest() runs a mixed list of feeds + queries, keeping only recent (≥ 2026) items, de-duped, newest-first.

Architecture

flowchart LR
  AIS[AIS tracks<br/>JSON / CSV] --> DET[detectors<br/>gaps · spoofing · loitering · rendezvous<br/>dark-rendezvous · GPS spoof/jam · port-calls]
  ZONES[(zones / geofences<br/>EEZ · ports · exclusion)] -.-> DET
  SANC[(sanctions list<br/>OFAC / EU / OFSI)] --> SC
  DET --> SC[risk scoring<br/>tier + plain-language reasons]
  SC --> WL[prioritized watchlist]
  WL --> GATE{--fail-on<br/>compliance gate}
  WL -. optional .-> AI[vision / reasoning add-ins<br/>via edgemesh / your fleet]

Demos

Five runnable, audience-varied scenarios in demos/, each loading the same bundled offline AIS fixture (demos/data/gulf_scenario.json — 7 vessels, 61 reports) and driving the real public API — no live feeds, no API keys, no network. Run them all (exits 0, doubles as a smoke test) or one at a time:

PYTHONUTF8=1 python demos/run_all.py            # all five, end to end
PYTHONUTF8=1 python demos/03_port_security.py   # or just one

#	Scenario	Audience	Shows
1	01_osint_analyst_sweep	OSINT / intel analysts	full detector suite → severity-weighted risk ranking + why the top hull leads
2	02_sanctions_compliance	sanctions / compliance	locate() watchlist: behaviour + MMSI/IMO/name screen → HIGH/MED/LOW tiers
3	03_port_security	port security / force protection	zone transits, risk-port itineraries, dark-rendezvous, CPA/TCPA standoff
4	04_researcher_export	researchers / data teams	one analysis → GeoJSON · KML · STIX 2.1 · CSV, dependency-free + deterministic
5	05_gps_spoofing_ew	EW / GPS-integrity analysts	circling-spoof tracks + jamming hotspots + identity-conflict spoofing

flowchart LR
    fix[(gulf_scenario.json<br/>offline fixture · 7 vessels)] --> load[core.load_messages]
    load --> sweep[1 · analyze<br/>risk ranking]
    load --> comp[2 · locate + sanctions<br/>tiered watchlist]
    load --> sec[3 · zones · ports · encounters<br/>spatial picture]
    load --> res[4 · intel export<br/>GeoJSON·KML·STIX·CSV]
    load --> ew[5 · GPS spoof / jamming]
    classDef f stroke:#6b46c1,stroke-width:2px;
    class fix f;

See docs/DEMOS.md for the full walkthrough and docs/ARCHITECTURE.md for how the pieces fit together.

Use it from any AI stack

maritimeint is interoperable with every popular way of using AI:

• MCP server — maritimeint mcp (Claude Desktop, Cursor, Cognis.Studio, uncensored-fleet)
• OpenAI-compatible / JSON — pipe maritimeint --format json locate <ais.json> into any agent or LLM
• LangChain · CrewAI · AutoGen · LlamaIndex — wrap the CLI/JSON as a tool in one line
• CI / scripts — exit codes + SARIF for non-AI pipelines

How it compares

	Cognis maritimeint	bellingcat
Self-hostable, no account	✅	varies
Single command, zero config	✅	⚠️
JSON + SARIF for CI	✅	varies
MCP-native (AI agents)	✅	❌
Polyglot ports (JS/Go/Rust)	✅	❌
Open license	✅ COCL	varies

Built in the spirit of bellingcat/toolkit, re-framed the Cognis way. Missing a credit? Open a PR.

Integrations

Pipes into your stack: SARIF for code-scanning, JSON for anything, an MCP server (maritimeint mcp) for AI agents, and a webhook forwarder for SIEM/Slack/Jira. See docs/INTEGRATIONS.md.

Forward the watchlist to your SOC via cognis-connect — STIX/MISP/Sigma/Splunk/Elastic/Slack/Discord/webhook, in one flag:

pip install "cognis-maritimeint[connect]"
maritimeint locate fleet.csv --sanctions s.json --emit stix > bundle.stix.json
maritimeint locate fleet.csv --sanctions s.json --emit splunk --emit-url $HEC --emit-token $TOK
maritimeint locate fleet.csv --sanctions s.json --emit slack  --emit-url $SLACK --emit-dry-run

Each flagged vessel becomes a canonical Finding (sanctioned → critical). --emit-dry-run previews the exact request without sending.

Install — every way, every platform

pip install "git+https://github.com/cognis-digital/maritimeint.git"    # pip (works today)
pipx install "git+https://github.com/cognis-digital/maritimeint.git"   # isolated CLI
uv tool install "git+https://github.com/cognis-digital/maritimeint.git" # uv
pip install cognis-maritimeint                                          # PyPI (when published)
docker run --rm ghcr.io/cognis-digital/maritimeint:latest --help        # Docker
brew install cognis-digital/tap/maritimeint                             # Homebrew tap
curl -fsSL https://raw.githubusercontent.com/cognis-digital/maritimeint/main/install.sh | sh

Linux	macOS	Windows	Docker	Cloud
scripts/setup-linux.sh	scripts/setup-macos.sh	scripts/setup-windows.ps1	docker run ghcr.io/cognis-digital/maritimeint	DEPLOY.md (AWS/Azure/GCP/k8s)

Related Cognis tools — the maritime / drone / defense-OSINT cluster

maritimeint sits in a wider open suite of defensive, analytical intelligence tools. Compose them: geolocate imagery, map ownership behind a flagged vessel, screen for sanctions, and correlate drone-detection events — all on your own hardware.

🔗 INTEROP.md — copy-paste tool-chaining recipes (sanctions screen → ownership/finance pivot → STIX/ATT&CK export → cognition/agents) + seven named reference stacks. Run a live chain end-to-end (offline): python examples/interop_demo.py — maritimeint → humind → agentlex → edgemesh brief.

Maritime & drone domain awareness

• uaslog — counter-UAS telemetry/log analyzer: flags drone-detection events, RF bands, and tracks
• awesome-drone-warfare-osint — citation-grade dataset: 8,300+ foreign components across 195+ platforms + a query.py compliance CLI
• frontline-drones — descriptive catalog of frontline & commercial drones + a counter-UAS sensor selection guide

Geospatial / GEOINT

• locateanything — infer where a photo was taken using a local vision + reasoning model (OSINT geolocation)
• geolens — image geolocation toolkit: EXIF, sun-shadow, OCR, reverse-search
• geoaoi-pro — MIL-STD-2525 / APP-6 symbology + area-of-interest helpers (QGIS-compatible)

Sanctions · ownership · finance

• corpmap — corporate structure & beneficial-ownership mapper (who really owns that hull)
• cryptotrace — blockchain investigator: ETH/BTC clustering + sanctions cross-reference

Threat intel · identity

• personagraph — identity-resolution dossier (username/email/phone, cross-platform)
• stixgen · iocextract · attackmap · ttphunt — IOC → STIX, ATT&CK mapping & hunting
• darkmirror — public leak-site index mirror for brand/exposure monitoring

Run it all privately → edgemesh (one OpenAI-compatible /v1 across your whole fleet) · uncensored-fleet

Explore the suite → 300+ open security & OSINT tools at github.com/cognis-digital · ⭐ awesome-cognis

Contributing

PRs, new rules, and demo scenarios are welcome under the collaboration-pull model — see CONTRIBUTING.md and SECURITY.md.

⭐ If maritimeint saved you time, star it — it genuinely helps others find it.

License

Source-available under the Cognis Open Collaboration License (COCL) v1.0 — free for personal, internal-evaluation, research, and educational use; commercial / production use requires a license ([email protected]). See LICENSE.

---

---

📡 Interop map — how this repo composes with the rest of the Cognis suite (private-AI backbone, agent language + cognition, domain intelligence).

📚 Sources & data — the real authoritative maritime-domain sources (OFAC SDN, AIS feeds, Sentinel-1, Equasis, C4ADS, CSIS/RUSI) behind the detectors, risk model, and sanctions screening — now 3× expanded with live 2026 feeds, search queries & keyless APIs, ingestible at runtime via livesearch.py.