Core Concepts

RAYS Spy — Agentic OSINT

RAYS Spy is an advanced Open-Source Intelligence (OSINT) platform that unifies hundreds of disparate reconnaissance tools under a single, cohesive AI-driven pipeline. It enables the RAYS Agent, acting through the Model Context Protocol (MCP), to perform deep, autonomous investigations across a vast array of data sources using local models.

1. The Agentic OSINT Loop

RAYS Spy doesn't just provide a list of tools—it orchestrates them. When the RAYS Agent receives an OSINT objective, it sequentially utilizes tools, evaluates their outputs, and determines the next optimal investigative step.

Furthermore, every step taken acts as a training signal. By leveraging the FOGR architecture, the local model is continuously fine-tuned on successful execution paths. The goal is agentic reconnaissance on anyone, anywhere, entirely locally and fast.

2. Identity & Social Footprint

  • Sherlock (sherlock.py): A high-performance wrapper around pySherlock for rapid username enumeration across 400+ social media networks, forums, and websites.
  • Search Collector (search_collector.py): Uses SerpAPI for batched Google Search collections to gather wide-net intelligence efficiently.
  • Spiderfoot: Deep integration with the Spiderfoot passive surface reconnaissance engine.

3. Face Recognition & Clustering

Visual intelligence is processed through a multi-stage computer vision pipeline:

  • InsightFace Integration (face_match.py, face_engine.py): Generates high-dimensional face embeddings using the ArcFace / buffalo_l model.
  • DBSCAN Clustering: Groups and clusters faces by cosine distance (Phase B5), enabling cross-platform identity tracking.
  • Perceptual Hashing (pHash): Detects duplicate images across the internet (Phase B3) to trace the origin of visual media.
  • Reverse Image Search (image_search.py): Automates reverse lookups across Google, Bing, and Yandex.

4. Real-time Surveillance & Tracking

  • Flight & Military Tracking: Search and track flights, including military aircraft, using flight numbers, origins, and destinations.
  • Satellite Integration: Access commercial and public satellite feeds, including real-time orbital paths and elements.
  • Global CCTV & Live Data: Tap into global public CCTV directories, real-time traffic data, and DEM (Digital Elevation Model) data.

5. Advanced Harvesting & Graph Building

  • Playwright: Automates headless browsers for scraping JS-rendered pages, utilizing urllib.request as a fast HTTP fallback.
  • Platform-Specific Validators: Uses YAML rules and HTML pattern matching to validate targets on platforms like GitHub, LinkedIn, and Twitter.
  • Regex-based PII Extractors: Harvests emails, phone numbers, and websites during the Evidence Harvesting phase (Phase A5).
  • Knowledge Graph (knowledge_graph.py): Automatically builds relationship graphs and entity linkages from all gathered intelligence.