![\"\"](\"https:\/\/ml6vmqguit1n.i.optimole.com\/w:auto\/h:auto\/q:mauto\/f:best\/https:\/\/172-234-197-23.ip.linodeusercontent.com\/wp-content\/uploads\/2026\/03\/image-6.png\")
<\/figure>\n\n\n\nThere are two ways to watch the world.<\/p>\n\n\n\n
The first is to stand back\u2014aggregate public signals, synthesize them with an LLM, render them on a 3D globe, and let the patterns speak to you. It’s elegant, scalable, and deeply useful.<\/p>\n\n\n\n
The second is to get closer. Capture the raw traffic. Analyze the RF spectrum. Build a living graph of what’s *actually* happening on the wire and in the air\u2014not what sources are reporting *about* it. It’s noisier, harder to deploy, and fundamentally different in kind.<\/p>\n\n\n\n
[World Monitor](https:\/\/worldmonitor.app) does the first brilliantly. RF SCYTHE does the second.<\/p>\n\n\n\n
This post is an honest technical comparison of both, written by someone who has spent months building one of them and studying the other.<\/p>\n\n\n\n
—<\/strong><\/p>\n\n\n\n ##<\/strong> Meet the Contenders<\/strong><\/p>\n\n\n\n ###<\/strong> World Monitor: The Global Dashboard<\/strong><\/p>\n\n\n\n World Monitor is a real-time global intelligence dashboard built by Elie Habib, released under AGPL-3.0. Current version: **<\/strong>2.4.1<\/strong>**<\/strong>. It aggregates 35+ data layers\u2014military flight tracking, conflict zones, infrastructure events, markets, satellite fire detection, cyber threat IOCs\u2014into a single WebGL 3D globe. The tech stack is formidable:<\/p>\n\n\n\n – **<\/strong>198 TypeScript files<\/strong>**<\/strong>, Vite 6 + deck.gl 9.2 + MapLibre 5<\/p>\n\n\n\n – **<\/strong>60+ Vercel Edge Functions<\/strong>**<\/strong> as a serverless backend<\/p>\n\n\n\n – **<\/strong>Groq (Llama 3.1 8B)<\/strong>**<\/strong> for AI synthesis, Transformers.js for in-browser NER\/embeddings<\/p>\n\n\n\n – **<\/strong>150+ RSS feeds<\/strong>**<\/strong> across 14 languages<\/p>\n\n\n\n – **<\/strong>Tauri 2 desktop builds<\/strong>**<\/strong> for Windows, macOS, Linux<\/p>\n\n\n\n – **<\/strong>PWA support<\/strong>**<\/strong> with offline map tiles<\/p>\n\n\n\n It deploys three distinct variants\u2014geopolitical, tech, finance\u2014from one codebase. It has a Country Instability Index that scores 22 nations on 10+ live signals. It has a Focal Point Detector that correlates entities across news, conflict data, military movements, and market signals to surface convergence *before* humans notice it.<\/p>\n\n\n\n It is, in short, a polished, production-grade, free alternative to tools that cost thousands of dollars per month.<\/p>\n\n\n\n ###<\/strong> RF SCYTHE: The Intelligence Organism<\/strong><\/p>\n\n\n\n RF SCYTHE started as an ATAK plugin experiment on a Pixel 7 Pro. Over 24 development checkpoints, it evolved into something harder to categorize: a self-hosted, multi-instance intelligence engine that fuses **<\/strong>live RF signals, real network traffic, PCAP captures, and hypergraph inference<\/strong>**<\/strong> into a continuously updating probabilistic knowledge graph.<\/p>\n\n\n\n The stack looks very different:<\/p>\n\n\n\n – **<\/strong>Python 3.12<\/strong>**<\/strong> core \u2014 Flask + SocketIO orchestrator, ~15,000 lines in `rf_scythe_api_server.py` alone<\/p>\n\n\n\n – **<\/strong>Hypergraph engine<\/strong>**<\/strong> \u2014 custom directed multigraph with typed edge ontology, confidence scoring, and temporal decay<\/p>\n\n\n\n – **<\/strong>Gemma 3 1B<\/strong>**<\/strong> (via Ollama) for local inference, **<\/strong>EmbeddingGemma<\/strong>**<\/strong> for semantic edge repair<\/p>\n\n\n\n – **<\/strong>Shadow Graph<\/strong>**<\/strong> \u2014 a probabilistic pre-reality layer where edges live until evidence promotes them<\/p>\n\n\n\n – **<\/strong>Threat Gravity Map<\/strong>**<\/strong> \u2014 canvas-based force simulation where node mass = threat weight, nodes physically pull toward each other in real time<\/p>\n\n\n\n – **<\/strong>Multi-instance orchestrator<\/strong>**<\/strong> \u2014 spawn N sovereign hypergraph instances; no shared state, no cross-contamination<\/p>\n\n\n\n – **<\/strong>PCAP\/FTP ingest pipeline<\/strong>**<\/strong> \u2014 live packet capture analysis feeding the graph<\/p>\n\n\n\n – **<\/strong>Docker image: 1.49 GB<\/strong>**<\/strong> (after three builds and a very humbling `.dockerignore` lesson)<\/p>\n\n\n\n Where World Monitor watches the world through public data, SCYTHE watches the *local observable universe* through packet captures and RF emissions\u2014then tries to reason about what it’s seeing.<\/p>\n\n\n\n —<\/strong><\/p>\n\n\n\n ##<\/strong> The Fundamental Philosophical Difference<\/strong><\/p>\n\n\n\n This is the most important comparison, and it’s not about features.<\/p>\n\n\n\n **<\/strong>World Monitor is an aggregator of reported reality.<\/strong>**<\/strong> It collects what humans and public APIs *say* is happening\u2014news articles, conflict databases, satellite imagery, ADS-B transponder broadcasts, AIS vessel pings. Its intelligence layer synthesizes these signals into coherent situational awareness. It is extraordinarily good at answering: *”What is the world reporting right now?”*<\/p>\n\n\n\n **<\/strong>SCYTHE is a constructor of inferred reality.<\/strong>**<\/strong> It collects raw observable data\u2014packet headers, RF signal characteristics, TCP connection timing, DNS queries\u2014and builds a probabilistic model of what entities exist, how they relate, and what they’re doing. It doesn’t ask what’s being reported. It asks: *”What does the evidence suggest is true?”*<\/p>\n\n\n\n The distinction matters more than it sounds.<\/p>\n\n\n\n Consider a scenario: a new C2 server stands up at 172.234.197.23. World Monitor will know about it when threat intelligence feeds (abuse.ch, AlienVault OTX) ingest and republish the indicator\u2014potentially hours or days later. SCYTHE will know about it when the first packet arrives and the hypergraph creates an edge between the scanning host and the observed service. The difference is the gap between *reported* and *observed*.<\/p>\n\n\n\n This isn’t a knock on World Monitor. Its model is deliberately designed for scale and accessibility\u2014anyone with a browser can run it. SCYTHE’s model requires hardware proximity to the traffic you want to analyze. Both are right for their domains.<\/p>\n\n\n\n —<\/strong><\/p>\n\n\n\n ##<\/strong> Technical Deep Dive: What Each Does Well<\/strong><\/p>\n\n\n\n ###<\/strong> World Monitor’s Strengths<\/strong><\/p>\n\n\n\n **<\/strong>The data breadth is staggering.<\/strong>**<\/strong> 220 military bases from 9 nations. Live ADS-B flight tracking. Naval AIS positions. ACLED + UCDP conflict events. NASA FIRMS satellite fire detection. Cloudflare internet outage data. 92 stock exchanges. 13 central banks. Undersea cable routes with landing points. All of this, free, in a single interface.<\/p>\n\n\n\n The **<\/strong>Country Instability Index (CII)<\/strong>**<\/strong> is genuinely clever engineering. It synthesizes 10+ weighted signals\u2014active conflicts, protest frequency, economic indicators from FRED, military surge detection, displacement data\u2014into a real-time stability score for 22 countries. This isn’t just data display; it’s a composite model that produces an actionable number.<\/p>\n\n\n\n The **<\/strong>3-tier caching architecture<\/strong>**<\/strong> (in-memory \u2192 Upstash Redis \u2192 upstream API) is production-hardened. The circuit breaker pattern means a failing data source degrades gracefully rather than cascading into a broken dashboard. The Groq-first \u2192 OpenRouter-fallback \u2192 browser-model-last-resort chain for LLM inference is the right way to build resilient AI features in 2026.<\/p>\n\n\n\n And the **<\/strong>deployment flexibility<\/strong>**<\/strong> is impressive: Vercel cloud, Docker self-hosted, Tauri desktop (.exe, .dmg, .AppImage), installable PWA. That’s the full matrix.<\/p>\n\n\n\n **<\/strong>The honest limitation<\/strong>**<\/strong>: every data point in World Monitor is downstream of something that already happened and got published. The ADS-B transponder data that World Monitor tracks can be spoofed. The conflict events are reported with latency. The threat intelligence IOCs are already known-bad by the time they appear. World Monitor is excellent for macro situational awareness. It is not designed for tactical edge detection of novel activity.<\/p>\n\n\n\n —<\/strong><\/p>\n\n\n\n ###<\/strong> SCYTHE’s Strengths<\/strong><\/p>\n\n\n\n **<\/strong>The hypergraph is the core differentiator.<\/strong>**<\/strong> Unlike a flat entity list or a knowledge graph with rigid schemas, SCYTHE’s hypergraph supports typed, confidence-weighted edges between arbitrary entities. An IP address can be connected to a hostname via `RESOLVES_TO`, to a session via `OBSERVED_IN`, to a service via `INFERRED_HOST_OFFERS_SERVICE`, and to a behavioral cluster via `MEMBER_OF_SWARM`. The graph doesn’t just store facts\u2014it stores *relationships with degrees of belief*.<\/p>\n\n\n\n The **<\/strong>Shadow Graph<\/strong>**<\/strong> is the feature that surprised me most in development. When the validator rejects an edge because evidence is insufficient, the edge doesn’t disappear\u2014it enters a probabilistic pre-reality layer with a confidence score. As more corroborating evidence arrives, the score climbs. When it crosses the promotion threshold, the edge materializes into the main graph. The system literally believes its own hypotheses into existence, with receipts.<\/p>\n\n\n\n This produced a log entry I’ve thought about since:<\/p>\n\n\n\n “`<\/p>\n\n\n\n [shadow] PROMOTED … kind=flow_observed confidence=0.74 after 1 attempt, age=2s<\/p>\n\n\n\n “`<\/p>\n\n\n\n Two seconds from shadow to reality. That’s pre-signature threat detection.<\/p>\n\n\n\n **<\/strong>The Threat Gravity Map<\/strong>**<\/strong> emerged from this model. Every node has a computed `mass`:<\/p>\n\n\n\n “`python<\/p>\n\n\n\n mass = (<\/p>\n\n\n\n 0.3 * log(node.degree + 1) +<\/p>\n\n\n\n 0.25 * log(node.flow_count + 1) +<\/p>\n\n\n\n 0.2 * node.persistence_score +<\/p>\n\n\n\n 0.15 * node.anomaly_score +<\/p>\n\n\n\n 0.1 * node.shadow_promotion_count<\/p>\n\n\n\n )<\/p>\n\n\n\n “`<\/p>\n\n\n\n Nodes with more connections, more traffic, more anomaly signals, and more shadow promotions are *heavier*. On the canvas force simulation, heavy nodes pull lighter nodes toward them. Threat clusters don’t just appear\u2014they *form*, visually, in real time. When you watch a new IP get pulled toward an existing heavy node within seconds of first observation, it’s unsettling in the best way.<\/p>\n\n\n\n **<\/strong>The honest limitation<\/strong>**<\/strong>: SCYTHE requires physical or network proximity to the traffic it analyzes. It cannot tell you what’s happening in eastern Ukraine from a browser tab. It can tell you everything about what’s happening on the network segment it’s connected to. It is a tactical and operational tool, not a strategic one.<\/p>\n\n\n\n —<\/strong><\/p>\n\n\n\n ##<\/strong> Side-by-Side Comparison<\/strong><\/p>\n\n\n\n | Dimension | World Monitor | RF SCYTHE |<\/p>\n\n\n\n |—|—|—|<\/p>\n\n\n\n | **<\/strong>Primary data<\/strong>**<\/strong> | 150+ public APIs, RSS feeds | Live PCAP, RF captures, network traffic |<\/p>\n\n\n\n | **<\/strong>Intelligence model<\/strong>**<\/strong> | Signal aggregation + LLM synthesis | Hypergraph inference + shadow graph |<\/p>\n\n\n\n | **<\/strong>Latency<\/strong>**<\/strong> | 5\u201315 min (news), real-time (ADS-B\/AIS) | Sub-second (live packet observation) |<\/p>\n\n\n\n | **<\/strong>AI integration<\/strong>**<\/strong> | Groq\/OpenRouter for summarization | Local Gemma 3 inference + semantic edge repair |<\/p>\n\n\n\n | **<\/strong>Visualization<\/strong>**<\/strong> | deck.gl 3D globe, 52 panels | Cesium 3D globe + canvas force simulation |<\/p>\n\n\n\n | **<\/strong>Deployment<\/strong>**<\/strong> | Vercel, Docker, Tauri, PWA | Docker (1.49 GB), self-hosted Linux |<\/p>\n\n\n\n | **<\/strong>Multi-instance<\/strong>**<\/strong> | Single app, 3 variants | N sovereign hypergraph instances |<\/p>\n\n\n\n | **<\/strong>Coverage<\/strong>**<\/strong> | Global (public data) | Local observable network\/RF environment |<\/p>\n\n\n\n | **<\/strong>Novel threat detection<\/strong>**<\/strong> | Known IOCs from threat feeds | Pre-signature, behavioral, first-observation |<\/p>\n\n\n\n | **<\/strong>Language support<\/strong>**<\/strong> | 14 languages, RTL | English (no i18n layer) |<\/p>\n\n\n\n | **<\/strong>License<\/strong>**<\/strong> | AGPL-3.0 | Proprietary (private) |<\/p>\n\n\n\n | **<\/strong>Target user<\/strong>**<\/strong> | OSINT analyst, researcher, journalist | Operator, red team, tactical network analyst |<\/p>\n\n\n\n | **<\/strong>Learning curve<\/strong>**<\/strong> | Low (browser, no setup) | High (Docker, Ollama, hardware proximity) |<\/p>\n\n\n\n | **<\/strong>API dependency<\/strong>**<\/strong> | Groq, OpenRouter, FRED, AIS, OpenSky | Ollama (local), optional external enrichment |<\/p>\n\n\n\n | **<\/strong>Offline capability<\/strong>**<\/strong> | PWA + offline maps | Fully offline capable |<\/p>\n\n\n\n —<\/strong><\/p>\n\n\n\n ##<\/strong> Where They Could Be More Powerful Together<\/strong><\/p>\n\n\n\n Here’s the part that keeps me up at night.<\/p>\n\n\n\n World Monitor knows that 172.234.197.23 is a Linode node in a specific ASN. It knows what news events originated from that IP’s general geography. It might even know from threat intelligence feeds that the IP has been associated with previous activity. But it doesn’t know *what that IP is doing right now on your network*.<\/p>\n\n\n\n SCYTHE knows exactly what 172.234.197.23 is doing right now\u2014what ports it’s probing, what session patterns it’s generating, what its timing fingerprint looks like, how its behavior is evolving over the last 48 hours. But it doesn’t have the geopolitical context about what that IP represents in the larger world.<\/p>\n\n\n\n A fusion of these two perspectives would be genuinely alarming. World Monitor’s CII scores, ASN metadata, and geopolitical context flowing *into* SCYTHE’s hypergraph as annotated edges. SCYTHE’s behavioral signatures flowing *into* World Monitor as a custom data layer\u2014not just “this IP is known bad” but “this IP is showing pre-C2 behavioral clustering with 0.74 confidence, right now.”<\/p>\n\n\n\n That’s not a feature request. That’s a different category of intelligence tool.<\/p>\n\n\n\n —<\/strong><\/p>\n\n\n\n ##<\/strong> The Deployment Architecture Contrast<\/strong><\/p>\n\n\n\n This deserves a dedicated section because it reveals the design philosophy of each project.<\/p>\n\n\n\n **<\/strong>World Monitor is cloud-native first.<\/strong>**<\/strong> The production path is `vercel deploy`. Sixty-plus serverless Edge Functions handle API proxying, LLM calls, and caching. This is the right choice for a globally accessible dashboard with no per-user infrastructure. The trade-off: you’re dependent on Vercel’s IP ranges (which some government APIs block, requiring a Railway WebSocket relay as fallback), and your data is transiting third-party infrastructure.<\/p>\n\n\n\n **<\/strong>SCYTHE is self-hosted first.<\/strong>**<\/strong> The orchestrator spawns subprocess instances with isolated data directories, each getting their own hypergraph, their own log files, their own LLM connection. The Docker image is 1.49 GB and runs entirely on your hardware. Ollama serves Gemma models locally. Nothing leaves your network unless you tell it to. The trade-off: you need to be on the same network as the traffic you want to analyze, and you need hardware capable of running quantized LLM inference.<\/p>\n\n\n\n The SCYTHE Docker build story is worth telling briefly. First image: 10.8 GB. Root cause: missing `.dockerignore` entries for `RFScytheARNative\/` (2.9 GB Android native build tree), `MediaPipeGestureAPK\/` (224 MB), and eight other large directories that had been added to the project over months. Second image with corrected exclusions: **<\/strong>1.49 GB<\/strong>**<\/strong>. The lesson: Docker’s `.dockerignore` is only as good as your knowledge of what’s in your own project directory.<\/p>\n\n\n\n —<\/strong><\/p>\n\n\n\n ##<\/strong> The LLM Integration Philosophies<\/strong><\/p>\n\n\n\n Both projects use language models, but in fundamentally different ways.<\/p>\n\n\n\n World Monitor uses LLMs as **<\/strong>synthesis engines<\/strong>**<\/strong>. Given 50 news items, produce a coherent world brief. Given a country’s data signals, generate an assessment. The model is consuming human-readable text and producing human-readable summaries. This is LLM use at its most legible\u2014you can read the output, trace it to the inputs, and evaluate its quality.<\/p>\n\n\n\n SCYTHE uses LLMs as **<\/strong>ontology repair engines<\/strong>**<\/strong>. When the graph produces an edge with an unrecognized `kind` value\u2014maybe `flow_observed` instead of the canonical `INFERRED_FLOW_OBSERVED`\u2014EmbeddingGemma computes semantic similarity between the malformed kind and every known edge type. If the closest match scores above threshold, the edge is repaired and committed. If not, it goes to the shadow graph. The model is operating on graph schema, not human language.<\/p>\n\n\n\n This is a stranger use of a language model. It treats semantic similarity as a form of schema validation. It’s also surprisingly effective: logs from development show consistent `~0.65` cosine similarity scores on edge kinds that differ only in casing or minor phrasing variations\u2014exactly the kind of ontology drift that accumulates when a system grows organically across 24 development checkpoints.<\/p>\n\n\n\n The failure mode is also instructive. When the semantic threshold is too high (was `0.82` at one point), valid edges get rejected and starve the inference pipeline. When it’s too low, unrelated concepts get conflated. Finding the right threshold is less a technical problem than an epistemological one: how confident does the system need to be before it’s allowed to believe something?<\/p>\n\n\n\n —<\/strong><\/p>\n\n\n\n ##<\/strong> On Monetization and the Open Source Question<\/strong><\/p>\n\n\n\n World Monitor is AGPL-3.0: you can run it, modify it, study it, but if you deploy a modified version, you must release the source. This is the right license for a public-good intelligence tool. It means the code stays open even as the project gains commercial traction. Elie Habib has built something genuinely valuable and given it to the world.<\/p>\n\n\n\n SCYTHE is private. That was a deliberate choice, for reasons that should be obvious to anyone who has read this far: a tool that does pre-signature threat detection using live packet captures and local LLM inference is dual-use in a way that requires careful consideration before open publication. RF intercept tooling has export control implications. Behavioral fingerprinting of network entities raises questions about appropriate use.<\/p>\n\n\n\n The monetization paths are also different.<\/p>\n\n\n\n World Monitor’s path is relatively clean: hosted premium tiers, enterprise data integrations, white-label licensing. The AGPL license means commercial users either comply (release modifications) or pay for a commercial license. Standard open core playbook.<\/p>\n\n\n\n SCYTHE’s path is narrower but more valuable per engagement: red team tooling, threat intelligence consulting, government contracts for edge-deployed tactical analysis systems. The Docker image makes it distributable. The multi-instance orchestrator makes it scalable. The local LLM stack makes it air-gap compatible. These properties are worth real money to people who work in environments where “just deploy to Vercel” is not an option.<\/p>\n\n\n\n —<\/strong><\/p>\n\n\n\n ##<\/strong> What Each Project Gets Right About the Future of Intelligence Tools<\/strong><\/p>\n\n\n\n World Monitor’s insight: