<a name="top"></a>

<div align="center"> <img src="https://capsule-render.vercel.app/api?type=rect&color=0:6b46c1,100:2b6cb0&height=120&section=header&text=MARITIMEINT&fontSize=48&fontColor=ffffff&fontAlignY=58" width="100%" alt="MARITIMEINT"/>

MARITIMEINT

AIS vessel tracking & sanctions-evasion anomaly detection

<img src="https://readme-typing-svg.demolab.com?font=Fira+Code&size=18&duration=3500&pause=1000&color=6B46C1&center=true&vCenter=true&width=720&lines=AIS+vessel+tracking++sanctionsevasion+anomaly+detection;Self-hostable+%C2%B7+MCP-native+%C2%B7+CI-ready+%C2%B7+polyglot" width="720"/>

OSINT / SIGINT — open-source intelligence collection and correlation.

</div>

pip install cognis-maritimeint
maritimeint locate demos/ais_sample.json   # → prioritized grey-fleet watchlist in seconds

🆕 New in v0.9 — track-interaction & vessel-behaviour intelligence

| | What changed | Try it | |---|---|---| | 🎯 | CPA / TCPA close-quarters — Closest Point of Approach + Time to CPA for every vessel pair; flags converging tracks projected to pass inside a danger radius (collision avoidance / standoff-perimeter breach). Pure relative-motion math — separation only, never an intercept | maritimeint close-quarters ais.json | | 🛰️ | Shadowing — one vessel persistently trailing another at a held standoff on a matched course (surveillance / interdiction / escort-precursor signature — distinct from a rendezvous) | maritimeint shadowing ais.json | | 🚢 | Convoy / co-movement — clusters of vessels moving together (tight grouping + matched heading & speed across epochs): escort groups & shepherded grey-fleet flotillas single-vessel detection misses | maritimeint convoy ais.json | | 🆘 | Drift / not-under-command — near-zero speed with erratic heading swing → disabled / dragging / possible-distress safety early-warning | maritimeint drift ais.json | | 🧩 | encounters mode + folded into analyze — all four run in one pass, score the risk ranking, and export to GeoJSON/KML/STIX/CSV unchanged | maritimeint encounters ais.json |

All four are pure-stdlib, additive layers — see the encounters guide and demos/05-encounters.

New in v0.8 — spatial intelligence, dark-STS & live 2026 sources

| | What changed | Try it | |---|---|---| | 🗺️ | Zone intelligence (geofencing) — define EEZs, sanctioned ports & exclusion / war-risk zones as GeoJSON; every finding is tagged with where it happened | maritimeint zones ais.json --zones zones.geojson | | 🌑 | Dark-rendezvous correlation — the real dark-STS move: one tanker kills AIS while another loiters at the spot (the case plain rendezvous can't see) | maritimeint dark-rendezvous ais.json | | 📡 | GPS spoofing & jamming — flags circling spoof tracks and jamming hotspots where many vessels snap to one synthetic position | maritimeint gps ais.json | | ⚓ | Port-call sequencing — reconstructs each vessel's itinerary and flags sanctioned-port legs | maritimeint port-calls ais.json --itinerary | | 🔴 | 3× more sources + real-time scraping — source catalog tripled with live 2026 feeds, plus a new keyless livesearch module that pulls current OSINT at runtime (Google News · RSS/Atom · DuckDuckGo), no API keys | python -m livesearch "sanctioned tanker" --when 7d |

All four detectors are pure-stdlib, additive layers folded into analyze / locate — see the v0.8 walkthrough and demos/04-dark-sts-zones.

<!-- cognis:example:start -->

Watch the walkthrough

A full narrated tour — setup, the tool in action, and every demo scenario:

▶ Watch the walkthrough (MP4)

🔎 Example output

Real, reproducible output from the tool — runs offline:

$ maritimeint --version
maritimeint 0.9.0

$ maritimeint --help
usage: maritimeint [-h] [--version] [--format {table,json}]
                   {analyze,gaps,jumps,loiter,spoof,rendezvous,dark-rendezvous,gps,close-quarters,shadowing,convoy,drift,encounters,zones,port-calls,locate,vision,export,menu,addins,import-ofac,feeds,import-sanctions,fetch-ais} ...

AIS vessel tracking & sanctions-evasion anomaly detection.

positional arguments:
  {analyze,gaps,jumps,loiter,spoof,rendezvous,dark-rendezvous,gps,close-quarters,shadowing,convoy,drift,encounters,zones,port-calls,locate,vision,export,menu,addins,import-ofac,feeds,import-sanctions,fetch-ais}
    analyze             run full detector suite + risk ranking
    gaps                detect AIS reporting gaps (going dark)
    jumps               detect implausible position jumps
    loiter              detect loitering / STS staging
    spoof               detect spoofing / identity conflicts
    rendezvous          detect vessel-to-vessel meetings
    dark-rendezvous     correlate a vessel going dark with another loitering
                        at the spot
    gps                 detect GPS spoofing (circling) / jamming hotspots
    close-quarters      CPA/TCPA: vessel pairs projected to pass dangerously
                        close
    shadowing           detect one vessel persistently trailing another at
                        standoff
    convoy              detect groups of vessels moving together (co-movement)
    drift               detect adrift / not-under-command vessels
                        (safety/distress)
    encounters          run the full track-interaction suite (CPA + shadow +
                        convoy + drift)
    zones               detect zone/geofence entries, exits and dwell
    port-calls          infer port calls + sequence itineraries (risk-tagged)
   

Blocks above are real maritimeint output — reproduce them from a clone.

Sample result format (illustrative values — run on your own data for real findings):

{
"analyze": [
  {
    "id": "123456",
    "risk_rank": 3,
    "events": [
      {
        "type": "gaps",
        "start": "2022-01-01T00:00:00Z",
        "end": "2022-01-02T12:00:00Z"
      },
      {
        "type": "jumps",
        "start": "2022-01-03T14:00:00Z",
        "end": "2022-01-04T16:00:00Z"
      }
    ]
  }
]
}

<!-- cognis:example:end -->

Contents

• Why maritimeint? · Features · What's new in v0.8 · Quick start · Example · Architecture · Demos · AI stack · How it compares · Integrations · Install anywhere · Related · Contributing

<a name="why"></a>

Why maritimeint?

AIS vessel tracking & sanctions-evasion anomaly detection — without standing up heavyweight infrastructure.

maritimeint is single-purpose, scriptable, and self-hostable: point it at a target, get prioritized results in the format your workflow already speaks (table · JSON · SARIF), gate CI on it, and let agents drive it over MCP.

<div align="right"><a href="#top">↑ back to top</a></div>

<a name="features"></a>

Features

• ✅ Parse Messages
• ✅ Load Messages
• ✅ Haversine Nm
• ✅ Detect Gaps
• ✅ Detect Speed Jumps
• ✅ Detect Loitering
• ✅ Detect Spoofing
• ✅ Detect Rendezvous (ship-to-ship transfer signature)
• ✅ CPA / TCPA close-quarters v0.9 — Closest Point of Approach + Time to CPA per vessel pair; flags converging tracks projected to pass inside a danger radius (the bridge collision-avoidance primitive, applied to AIS history for safety & force-protection standoff monitoring — separation only, no intercept/targeting)
• ✅ Shadowing v0.9 — one vessel persistently trailing another at a held standoff on a matched course; reports leader/follower roles (surveillance / interdiction / escort-precursor signature, distinct from a rendezvous)
• ✅ Convoy / co-movement clustering v0.9 — groups of vessels moving as one formation (proximity + matched heading & speed across epochs): escort groups & shepherded flotillas single-vessel detection treats as unrelated
• ✅ Drift / not-under-command v0.9 — near-zero speed with erratic heading swing → disabled / anchor-dragging / possible-distress safety early-warning
• ✅ encounters mode v0.9 — runs all four interaction/behaviour detectors in one pass; also folded into analyze so they score the risk ranking and flow through every exporter (guide)
• ✅ Dark-rendezvous correlation v0.8 — one vessel goes dark while another loiters at the vanish point (the dark-STS signature rendezvous misses, because only one party is broadcasting)
• ✅ Zone intelligence / geofencing v0.8 — GeoJSON or native polygons + great-circle "circle" zones (EEZs · sanctioned ports · exclusion / war-risk); entry/exit/dwell events + every positional finding tagged with its zone
• ✅ GPS spoofing & jamming v0.8 — circle_spoof (a track populating the whole compass around a tight centroid) + gps_jamming (many distinct MMSIs pinned to one synthetic position)
• ✅ Port-call sequencing v0.8 — dwell-based port calls from a built-in (or custom) registry, sequenced into per-vessel itineraries with sanctioned-port legs flagged
• ✅ Live 2026 sources + real-time scraping v0.8 — livesearch.py: keyless, stdlib, real-time web-search + RSS/Atom ingestion (web_search · fetch_feed · ddg_search · harvest); the SOURCES.md catalog now carries 3× the feeds, queries & APIs
• ✅ Native intel export v0.9 — turn any analysis into GeoJSON (Leaflet/Mapbox/QGIS/kepler.gl), KML (Google Earth / marine charts), STIX 2.1 bundle (threat-intel platforms) or CSV — zero dependencies: maritimeint export ais.json --to geojson
• ✅ LocateAnything watchlist — one call → prioritized, explained grey-fleet watchlist (HIGH/MEDIUM/LOW + plain-language reasons)
• ✅ Sanctions cross-reference — match tracked vessels to an OFAC/EU/OFSI-style list by MMSI / IMO / name
• ✅ Composable AI add-ins — optional vision (imagery triage) + reasoning (narrative assessment) that stack onto the stdlib core, via the Cognis fleet / edgemesh; hardware/availability-gated (off if no backend)
• ✅ Multi-level interactive menu (maritimeint menu)
• ✅ Runs on Linux/macOS/Windows · Docker · devcontainer
• ✅ Ports in Python, JavaScript, Go, and Rust (ports/)

Grey-fleet watchlist + AI add-ins

maritimeint locate demos/ais_sample.json --sanctions demos/sanctions_sample.json
#  [HIGH ] 210111000 NEPTUNE STAR [SANCTIONED]  score=12
#        - ON SANCTIONS LIST (...)   - AIS gap 9h (going dark)
#        - rendezvous 90min, 0.008nm (possible ship-to-ship transfer)
maritimeint addins                 # which AI add-ins are reachable right now
maritimeint locate <ais.json> --ai # augment with the reasoning model if a backend is up
maritimeint menu                   # interactive, multi-level

# point the add-ins at a LIVE edgemesh gateway (or any OpenAI-compatible /v1