SkyRecon

OSINT CLI for aircraft + vessels — race-not-fallback sources, proximity, geofence, PDF

v1.0.1

Linux

Quick Start

Install via jcli

jcli install skyrecon

Live position

# Aircraft — races OpenSky / ADSB.lol / Airplanes.live in parallel
skyrecon track --icao 4ca123

# Vessel
skyrecon track --mmsi 211234560

# Identity + metadata
skyrecon id --icao 4ca123

Area sweeps + reverse-geo

# Named region preset
skyrecon bbox --preset ENGLISH_CHANNEL --type both --limit 50

# Custom bbox
skyrecon bbox --lat1 49.4 --lon1 5.7 --lat2 50.2 --lon2 6.6

# What is overhead this point?
skyrecon geo --lat 49.6 --lon 6.2 --radius 25

Persistent monitor + geofence (NEW)

# Watch + fire APPEARED / MOVED / LOST events
skyrecon watch --icao 4ca123 --interval 30

# NEW: alert on entry/exit of a 25km radius around Luxembourg
skyrecon watch --icao 4ca123 --alert-near 49.6,6.2,25

# Pipe alerts to a Signal webhook
SIGNAL_WEBHOOK=https://… skyrecon watch --icao 4ca123

NEW v1.0: proximity / airport / port / replay

# Find every aircraft / vessel pair currently within 5 km of each other
skyrecon proximity --preset ENGLISH_CHANNEL --max-km 5

# Aircraft within 25km of London Heathrow (IATA or ICAO code)
skyrecon airport LHR

# Vessels within 50km of Rotterdam (UN/LOCODE)
skyrecon port NLRTM

# Replay a saved history file at 100× wall-clock for downstream analytics
skyrecon replay session.jsonl --speed 100 --ndjson

PDF dossier + Tor anonymity

# Generate an OSINT PDF report (cover, identity, history table, stats, raw JSON)
skyrecon report --icao 4ca123 --hours 48

# Route every HTTP call through Tor SOCKS5 (or set SKYRECON_TOR)
skyrecon --tor track --icao 4ca123

What's new in v1.0 (Rust rewrite)

Race-not-fallback for aircraft sources. Python tried OpenSky→ADSB.lol→Airplanes.live in priority order, blocking on each. Rust spawns all three concurrently and returns the first viable hit — typically halves live-track latency.
Full ITU MMSI MID database (~250 entries, was 70) + full ICAO Mode-S country allocations (~200 ranges, was 35). Country decoding is now reliable on every region.
NEW proximity subcommand. Given a bbox + max-km, finds every target pair (aircraft↔aircraft, vessel↔vessel, or cross-type) currently within that distance. Output ranked by min-distance.
NEW airport / port subcommands. Gate-watch a single ICAO/IATA airport or UN/LOCODE port using an embedded DB of major hubs. For arbitrary coords, fall through to geo --lat --lon.
NEW replay subcommand. Stream a saved history (JSONL) at configurable speed. Pipe straight into Grafana / SIEM / custom dashboards as if live.
NEW --alert-near=LAT,LON,KM on watch — fires ENTERED_ZONE / EXITED_ZONE on radius transitions. Pairs with Signal webhook.
NEW --tor flag — route every HTTP call via SOCKS5 127.0.0.1:9050 (override with $SKYRECON_TOR).
NEW NDJSON output + 5 expanded bbox presets (HORMUZ, PANAMA_CANAL, MALACCA, BALTIC_GATEWAY, ENGLISH_BAY).
Single binary, zero runtime deps. Replaces aiohttp + rich + reportlab + python-dotenv + geojson — each previously a deploy headache on hardened hosts.

Subcommands

Command	What it does
`track`	Real-time position (race-not-fallback across sources)
`id`	Identity + metadata (registration, operator, flag country)
`bbox`	Geo bounding-box area sweep with presets
`history`	Track replay with timestamps (GeoJSON LineString-ready)
`watch`	Persistent monitor + Signal webhook + `--alert-near`
`fleet`	Enumerate every ICAO24 for an operator
`geo`	What is overhead a coordinate right now
`report`	Generate a full OSINT PDF dossier
`proximity` NEW	Find target pairs within K km of each other
`airport` NEW	Aircraft around a given airport (ICAO/IATA)
`port` NEW	Vessels around a given port (UN/LOCODE)
`replay` NEW	Stream a saved history file as a time-series

Credentials

SkyRecon works without credentials but more sources unlock the full API. Set in env (or ~/.skyrecon/.env):

Variable	Source
`OPENSKY_USER` + `OPENSKY_PASS`	OpenSky Network — higher rate budget + history endpoint
`AISHUB_USER`	AISHub — vessel live positions (free signup)
`POSITIONAPI_URL`	Self-hosted position-api — vessel history + bbox
`SIGNAL_WEBHOOK`	Webhook URL for watch-mode alert delivery
`SKYRECON_TOR`	SOCKS5 URL override for `--tor` (default `socks5h://127.0.0.1:9050`)