Third Eye: A Self-Hosted OSINT Dashboard for Live Flight, CCTV and Seismic Layers
A production-grade OSINT platform that provides situational awareness across multiple intelligence domains.
At a glance
- What is it?
- Third Eye is an MIT-licensed Next.js and MapLibre dashboard that pulls public feeds for aviation, maritime, CCTV, seismic, fire and conflict data into one map. It installs in minutes with no API keys, but its RECON toolkit needs a separate scanner backend.
- Who is it for?
- Third Eye suits analysts, researchers and self-hosters who want many public feeds on one WebGL map without wiring each source themselves. It is the wrong tool if you need authenticated maritime or satellite coverage, because AIS and N2YO keys are optional in the template and the keyless defaults are what you get.
- Can I use it commercially?
- Yes. MIT is a permissive licence: you can use, modify and sell software built on it, as long as you keep its copyright and licence notices.
- Is it still maintained?
- Yes. The repository last received commits 97 days ago.
- What is it written in?
- Mainly TypeScript, according to GitHub's language statistics.
Answers come from the project's GitHub data, last synced on September 17, 2026, and from our analysis. They are not legal advice.
DEEP OPEN-SOURCE ANALYSIS
What Third Eye aggregates and who it is built for
Third Eye is a Next.js 16 application that renders live intelligence feeds on a MapLibre GL map. The README lists thirteen or more domains: aviation from OpenSky Network, maritime port and chokepoint data, more than 2,000 CCTV cameras from agencies such as TfL, WSDOT, Caltrans, NYC DOT and VicRoads, seismic events from the USGS API, active fire hotspots from NASA FIRMS, live news streams from 25 or more broadcasters, weather events from NASA EONET, space weather and satellites from NOAA SWPC and N2YO, CVE data from NVD, conflict zones, crypto wallet tracing, OFAC sanctions search, and a Telegram layer built on the public t.me/s/ web preview. The intended user is someone who wants situational awareness without assembling a dozen scrapers and a map. The README positions it as a production-grade OSINT platform, and the repository ships a Dockerfile, a docker-compose.yml, a SECURITY.md and a docs directory, which suggests it is meant to be run rather than only read. It is not a threat-intelligence platform with curated feeds; it is a viewer for public sources, and the value is in the aggregation and the rendering, not in any proprietary data.
How the layers, viewport loading and RECON toolkit fit together
The architecture is a single Next.js app with a MapLibre GL front end. The README states that all map data is rendered through WebGL rather than the DOM, and that layers load progressively when activated, with viewport-aware fetching so only the visible region is requested. That design explains the claim of handling thousands of concurrent entities: the browser is drawing points on the GPU, not creating DOM nodes per aircraft. The RECON toolkit is separate. It includes a TCP connect port scanner, DNS record resolution, WHOIS, an SSL/TLS certificate chain inspector, IP geolocation with ASN and reputation, CVE lookup against NVD, BTC and ETH wallet tracing against blockstream.info and Blockscout, and full-text OFAC SDN search through OpenSanctions. Those active features do not run inside the Next.js process by default. The configuration template exposes SCANNER_URL and SCANNER_KEY, and the README states plainly that without them the RECON toolkit returns 503 while every other layer works. So the deployment has two halves: a keyless map and feed viewer, and an optional scanner backend you must supply and key yourself. The Telegram layer is described as scraped from the unauthenticated web preview, with no Bot API token and no MTProto, which keeps setup simple but ties that layer to whatever the public preview exposes.
Installing Third Eye with npm or Docker
The README gives three install paths. The npm route is the shortest and needs no keys. Clone the repository, install dependencies, and start the development server:
git clone https://github.com/eli-labz/Third-Eye.git
cd Third-Eye
npm install
npm run devThe README says to open http://localhost:3000, and that no API keys are needed. If you prefer containers, the compose file pulls ghcr.io/aiacos/third-eye:latest and keeps a build block as a fallback. Copy the environment template first, because the compose file marks .env as optional but reads it when present:
cp .env.template .env
docker compose up -dThe container listens on port 3000 internally. To publish a different host port, set THIRDEYE_PORT in .env; the compose file maps "${THIRDEYE_PORT:-3000}:3000". The fastest route is the prebuilt image directly:
docker pull ghcr.io/aiacos/third-eye:latest
docker run -d -p 3000:3000 --env-file .env ghcr.io/aiacos/third-eye:latestAfter the container starts, the map should load with the keyless layers active. The Dockerfile builds a standalone Next.js output on node:22-alpine and runs it as a non-root nextjs user, so the image follows a standard multi-stage pattern.
Configuration keys and the 503 you will hit first
The environment template separates optional rate-limit keys from the scanner backend. THIRDEYE_PORT controls the published host port. SCANNER_URL and SCANNER_KEY point at the RECON backend, and the README suggests generating the key with openssl rand -hex 32. FIRMS_API_KEY, OPENSKY_CLIENT_ID, OPENSKY_CLIENT_SECRET, N2YO_API_KEY and AIS_API_KEY raise rate limits on their respective feeds. The failure mode to expect on a fresh install is the RECON toolkit returning 503 because SCANNER_URL and SCANNER_KEY are empty. That is documented behaviour, not a bug, and it means the port scanner, DNS, WHOIS, SSL, IP intelligence, CVE and wallet tracing features are unavailable until you stand up that backend. The README does not document what that backend must implement, so anyone planning to use the active scanning features should read the docs directory and the AGENTS.md and GUARDRAILS.md files in the repository root before assuming the interface is settled. The passive layers, by contrast, work as soon as the app starts.
Where Third Eye is the wrong choice
The maritime layer is the clearest limitation. The README describes it as 39 global ports and 10 chokepoints from static naval intelligence, and AIS_API_KEY is listed as an optional key for aisstream.io. A static port list is not live vessel tracking, so anyone expecting a moving AIS picture will be disappointed unless they configure that key and the integration behind it, which the README does not explain. The same caution applies to satellites: N2YO_API_KEY is optional, and the README does not say what the keyless fallback shows. The crypto tracing is limited to BTC and ETH, so other chains are out of scope. The CCTV layer depends on third-party agency streams that can go offline without notice, and the news layer depends on 25 or more external broadcasters. Finally, this is a viewer, not a collection platform: it does not store historical data for later analysis, and the README does not describe a database or retention model. If your work requires archiving events or running queries over past data, Third Eye is the wrong layer in the stack.
How it differs from running Kepler.gl or a Grafana dashboard
The closest comparison is a general geospatial visualisation tool such as Kepler.gl. Kepler.gl is a client-side analysis environment: you load your own datasets, style them, and explore. Third Eye is the opposite: the datasets are chosen for you and refreshed from public APIs, and the work went into the feed integrations and the layer toggles rather than into data import. A Grafana dashboard with a map panel is another option, and it is better if you already run Prometheus-style time-series data and want alerting and retention. Third Eye has no alerting and no retention described in the README. Its distinctive pieces are the RECON toolkit and the Telegram geoparsing layer, neither of which a generic dashboard provides. The trade-off is control: with Kepler.gl or Grafana you decide the sources and the schema, while Third Eye decides the domains and you accept its coverage.
Maintenance, licence and the cost of upgrading
The repository is not archived, and the last push was on 2026-06-13, which is more than six months before today. Treat it as a project that has shipped a release and then gone quiet rather than one with a steady commit cadence. The version in package.json is 0.1.0 and the package is marked private, so there is no npm package to depend on; you consume the source or the GHCR image. Upgrades mean pulling a new image or rebasing your checkout, and because the app is a single Next.js service with no documented database, there is no migration step described. The stack is current and fast-moving: Next.js 16.2.6, React 19.2.4, MapLibre GL 5, Tailwind 4 and Vitest 3. Pinning the GHCR tag rather than tracking latest is the safer default, since the compose file uses ghcr.io/aiacos/third-eye:latest. The licence is MIT, which permits commercial use and modification provided the copyright notice and permission notice are retained; that is a summary of the licence text, not legal advice, and the LICENSE file is the authority. One practical note for self-hosters: the compose file declares an external network named umami_default, so a plain docker compose up will fail unless that network exists or you edit the file.
Editorial conclusion
Third Eye suits analysts, researchers and self-hosters who want many public feeds on one WebGL map without wiring each source themselves. It is the wrong tool if you need authenticated maritime or satellite coverage, because AIS and N2YO keys are optional in the template and the keyless defaults are what you get. Before adopting it, check the licence file, the SECURITY.md and the docs directory, and decide whether you will run the separate scanner backend that the RECON toolkit depends on. Without SCANNER_URL and SCANNER_KEY, that toolkit returns 503 and you are left with the map layers alone, which may be all you need.
Frequently asked questions
How do I use Third Eye?
Clone the repository, run npm install and npm run dev, then open http://localhost:3000. The README states that no API keys are needed for the core layers, and that layers load when you toggle them on the map.
How do I install Third Eye?
The README gives three routes: npm with git clone, npm install and npm run dev; Docker with cp .env.template .env followed by docker compose up -d; or the prebuilt image ghcr.io/aiacos/third-eye:latest run with docker run -d -p 3000:3000. The container listens on port 3000 internally and the host port follows THIRDEYE_PORT.
Does Third Eye need API keys?
No for the core layers, which the README describes as public and keyless. Optional keys such as FIRMS_API_KEY, OPENSKY_CLIENT_ID, OPENSKY_CLIENT_SECRET, N2YO_API_KEY and AIS_API_KEY raise rate limits, and SCANNER_URL with SCANNER_KEY are needed for the RECON toolkit.
Why does the RECON toolkit return 503 in Third Eye?
The README states that without SCANNER_URL and SCANNER_KEY the RECON toolkit returns 503, while every other layer works out of the box. You need to supply a scanner backend and a key, which the README suggests generating with openssl rand -hex 32.
Can I self-host Third Eye on a custom port?
Yes. The container always listens on 3000, and the compose file maps "${THIRDEYE_PORT:-3000}:3000", so setting THIRDEYE_PORT in .env changes the published host port without editing the compose file.
Community notes