Private global intelligence // macOS
See the world clearly before it changes.
Crystal Ball turns the world's live signals into calm, legible intelligence—across markets, conflict, climate, infrastructure, and more. Private by design. Built for the Mac.
UTC / LIVE SIGNAL
- Live panels
- 182
- 3D globe layers
- 22
- AI summaries
- Local-first
Signal mesh // live
Six domains. One connected view.
The signal mesh links related events without turning awareness into noise. Hover a node to bring one domain into focus.
Source dossier
One event, its originating reports, related signals, and the assessment—kept together.
CONFIDENCE 0.86 · 04 SOURCES
01 // Unified intelligence
Four ways to read the world.
Move from global pattern to local detail without losing context. Every view shares one intelligence layer.
Full intelligence
Conflict, infrastructure, cyber activity, weather, disasters, and geopolitical signals in one connected view.
Tech pulse
AI, startups, cloud platforms, service health, and the developer ecosystem—without the tab overload.
Financial context
Markets, commodities, macro signals, sectors, and central banks interpreted alongside world events.
The brighter signal
Science, conservation, health, and human progress for a more complete picture of what is changing.
How it works
From public signals to private understanding.
Crystal Ball gathers, relates, and presents global context while keeping your credentials and AI workflows under your control.
Bring your sources
Connect public feeds and optional providers. Credentials are stored in macOS Keychain, never in the interface.
Find the shared signal
Local-first on-device AI organizes reporting, links related events, and keeps sources visible.
Move through the world
Use the God's Eye 3D globe, 182 live panels, or the ⌘K command palette to move from overview to detail.
Agent access // local and guarded
Give your AI the evidence—not unchecked conclusions.
Crystal Ball exposes a local command-line and MCP surface for compatible AI agents. The app remains the source of truth, and each response carries sources, timestamps, warnings, and collection caveats.
Direct sources
Provider observations enter Crystal Ball with their origin and collection context intact.
Local sidecar
The running Mac app authenticates requests and serves only approved local routes.
MCP safety layer
Capability checks, route policy, structured output, and quarantine rules are applied.
Agent-ready output
The agent receives evidence, freshness, provenance, and limitations it can explain to you.
Check, prove, and export.
The installed command surface keeps diagnostics and evidence handling explicit. Human output explains the next step; JSON output is suitable for a privacy-safe agent handoff.
crystalball doctor
crystalball safeguard-demo
crystalball evidence
Know what a tool can change.
Plain-language labels are generated from the same registry the MCP server uses at runtime, reducing documentation drift without replacing authorization.
Carry the seams with the answer.
Evidence Packet v1 preserves source provenance, freshness, missing capabilities, algorithm and quarantine context, tool permissions, and an integrity digest. A Compatibility verdict identifies mismatched desktop, MCP, skill-contract, or protocol versions before analysis proceeds.
Crystal Ball must be open for live agent data. The optional background monitor checks drift and quarantine state; it does not replace the running app or silently publish your credentials.
Operating concept // signal to action
What we intend to watch—and what we do next.
Crystal Ball is meant to reduce the distance between an emerging signal and a disciplined decision. It does not replace an emergency manager, meteorologist, financial adviser, or primary source. It organizes the evidence those decisions should begin with.
Observe broadly. Verify narrowly. Act through the proper authority.
Our intended use is continuous environmental and strategic awareness: establish a normal baseline, detect material change, determine whether the change affects a person, place, asset, route, or market exposure, and then verify the finding at the source. Crystal Ball should make uncertainty inspectable. Every decision record should preserve the issuing authority, observation time, source freshness, geographic relevance, confidence, and the condition that would reverse the judgment.
Weather, storms, and local conditions
Forecast and alert layers combine current weather with official warning products so the operator can distinguish inconvenience from a developing safety issue. Saved places and regional views make the analysis personal: not merely where a storm exists, but when it may affect home, family, travel, utilities, or a supply route.
- Watch: NWS watches and warnings, forecast changes, precipitation, wind, severe convection, tropical systems, aviation weather, and space-weather conditions.
- Interpret: severity, certainty, onset, expiration, forecast trend, distance, and whether multiple government warnings converge.
- Support: decisions to reschedule travel, secure outdoor property, charge devices, review shelter locations, or begin a household preparedness plan.
Wildfire & air quality
Satellite detections and incident feeds identify active heat signatures and wildfire activity; atmospheric services provide local AQI and pollutant readings. Used together, they help separate a distant fire headline from a smoke or evacuation risk that is plausibly relevant to a saved location.
- Watch: NASA FIRMS and INPE fire detections, wildfire incidents, smoke context, Open-Meteo and OpenAQ readings, US AQI, PM2.5, PM10, ozone, and nitrogen dioxide.
- Interpret: proximity, detection age, fire radiative power, wind direction, repeated detections, AQI trend, and official incident or evacuation information.
- Support: checking clean-air space readiness, limiting exposure, protecting vulnerable household members, reviewing evacuation routes, and following local fire authority instructions.
Flood & severe weather
Flood risk is treated as a compound problem rather than a weather icon. Official alerts, forecast rainfall, USGS WaterWatch gauge stages, dam and levee warnings, and global disaster activations can be read beside roads, population, power, and other exposed infrastructure.
- Watch: flash-flood and river warnings, gauges at action or flood stage, dam or levee emergencies, FEMA and GDACS reporting, and Copernicus Emergency Management Service activations.
- Interpret: upstream conditions, stage category, warning polygon, timing, terrain, low-water crossings, and whether an alternate route remains outside the hazard area.
- Support: avoiding flooded travel corridors, moving vehicles or equipment earlier, protecting documents and medication, and acting immediately on evacuation or shelter orders.
Markets, macro, and material events
Market prices are read alongside the conditions that may explain them. Indexes, equities, commodities, foreign exchange, crypto, volatility, sentiment, macro series, energy data, and corporate filings provide a structured way to test whether a geopolitical or environmental event is producing a broader economic response.
- Watch: market quotes, sector and commodity moves, VIX, yield and rate data, FRED economic series, foreign exchange, ETF flows, sentiment, and SEC EDGAR material-event filings.
- Interpret: magnitude, duration, liquidity, cross-asset confirmation, scheduled releases, correlation versus causation, and feed timestamp.
- Support: reviewing exposure, forming a bounded hypothesis, setting a monitoring threshold, and deciding what additional research is required—not automatic trading.
Power, networks, transport, and supply
A hazard becomes operational when it interrupts the systems people depend on. Crystal Ball connects grid outages, internet disruptions, water quality, radiation monitoring, aviation hazards, maritime chokepoints, shipping activity, and pharmaceutical supply so secondary effects can be examined before they become isolated surprises.
- Watch: county-level power outages, IODA internet disruptions, EPA water and radiation data, FAA ground stops and SIGMETs, port and chokepoint flows, drug shortages, and recalls.
- Interpret: affected population or meters, geographic overlap, duration, restoration information, redundancy, and downstream dependencies.
- Support: charging backup power, changing a route, validating communications alternatives, reviewing essential supplies, and escalating a continuity plan.
Conflict, cyber, health, and crisis
The broader threat layer helps the operator recognize when a local concern is part of a larger pattern. Conflict events, military movement, sanctions, cyber indicators, exploited vulnerabilities, disease outbreaks, earthquakes, and geocoded reporting can be correlated by region and time without collapsing unlike evidence into one score.
- Watch: ACLED events, military aircraft and vessels, CISA known-exploited vulnerabilities, malicious infrastructure, WHO and ReliefWeb outbreaks, USGS earthquakes, sanctions, and crisis reporting.
- Interpret: source independence, affected entity, recency, confidence, escalation path, and potential interaction with infrastructure or markets.
- Support: prioritizing attention, checking an asset or region watchlist, patching an exposed system, or requesting specialist review.
SMS-ready alerts and family check-ins.
Crystal Ball turns a saved place, current status, fallback plan, and check-in cadence into a concise message that can be pasted into SMS, Signal, or another communications channel. The goal is to reduce hesitation and ambiguity when conditions are changing.
One-tap status templates
The Tactical Comms panel prepares place-aware updates for Safe, Moving, Stuck, Need Pickup, and Need Meds. Each message includes the saved place, UTC time, status-specific action, primary channel, fallback ladder, and next check-in window.
Compact location share codes
Family Tracker generates and parses a short location, status, and optional battery record designed to survive the character and bandwidth limits of SMS or radio. Family locations remain local until the operator chooses to share a code.
WM:lat,lon,STATUS,BATT%
Prepared emergency outreach
In War Mode, Alert Family builds the primary communications message and copies it for immediate use. The plan can prioritize a family SMS or Signal thread, then step down to voice, radio, mesh, satcom, or a rally point when the primary channel fails.
Define home, family, travel, or evacuation locations and the contacts responsible for each plan.
Order SMS, Signal, calls, radio, mesh, satcom, and rally procedures before networks degrade.
Generate a consistent update and copy it into the channel that is still available.
If a check-in is missed, use the next channel or rendezvous step defined in the plan.
Weather-to-action playbook
A repeatable sequence for severe weather, wildfire, smoke, flood, earthquake, or other physical hazards near a saved place.
- Detect and locate. Open the alert, identify the original authority, map the polygon or coordinates, and compare them with home, family, travel, and critical assets.
- Check time and quality. Confirm issuance, onset, expiration, sensor age, and feed health. Treat stale or unavailable data as uncertainty.
- Build the exposure picture. Add wind, rainfall, river gauge, fire, AQI, road, power, communications, and population layers that are relevant to the hazard.
- Corroborate the decision trigger. Seek the issuing agency, local emergency management, utility, fire authority, or evacuation source. Identify what would move the posture from monitor to prepare or act.
- Act, communicate, and reassess. Follow official instructions, contact affected people, execute the appropriate household or continuity plan, and set the next review time.
Markets-to-decision playbook
A disciplined research loop for understanding a move without mistaking a live dashboard for a trading system.
- Define the exposure. Name the ticker, sector, commodity, currency, region, or economic variable and the time horizon that matters.
- Measure the move. Compare price, volatility, volume or flow, and related assets against a baseline; verify timestamp, session status, and delayed-data caveats.
- Test the explanation. Review macro releases, rates, energy prices, SEC filings, sanctions, conflict, infrastructure, and weather evidence. Distinguish correlation from a demonstrated cause.
- State a falsifiable hypothesis. Record what is known, what is inferred, confidence, alternative explanations, and the signal that would invalidate the view.
- Monitor rather than chase. Add focused ticker or region watchlists and threshold alerts, then seek regulated or professional advice before any consequential transaction.
| Mission | Representative sources | What Crystal Ball contributes | Operator decision |
|---|---|---|---|
| Weather | NWS, OpenWeatherMap, NOAA products | Conditions, watches and warnings, location context, severity and timing | Monitor, prepare, avoid travel, or verify with the issuing authority |
| Wildfire | NASA FIRMS, INPE, incident feeds | Satellite detections, incident proximity, recency, smoke context | Review fire authority notices, clean-air readiness, and evacuation routes |
| Air quality | Open-Meteo and OpenAQ | US AQI, PM2.5, PM10, ozone, nitrogen dioxide, local trend | Reduce exposure and follow public-health guidance when thresholds rise |
| Flood and disaster | USGS WaterWatch, NWS, FEMA, GDACS, Copernicus EMS | Gauge stage, official warnings, disaster activation, exposed geography | Avoid flooded routes and follow evacuation or shelter instructions |
| Markets and macro | Finnhub or Stooq, FRED and SEC EDGAR, Treasury and BLS | Quotes, volatility, rates, macro series, filings, cross-domain context | Research exposure, test a hypothesis, and seek qualified advice |
| Infrastructure | ORNL, IODA, EPA, FAA, maritime and supply feeds | Power, network, water, radiation, transport, chokepoint, and shortage signals | Adjust continuity, communications, travel, and essential-supply plans |
| Cyber | CISA KEV, ThreatFox, URLhaus, OpenPhish, OTX | Known exploitation, indicators, malicious infrastructure, entity lookup | Validate exposure, prioritize patching, block indicators, escalate review |
| Conflict and crisis | ACLED, GDELT, DoD/NATO reporting, WHO, ReliefWeb, USGS | Regional events, military posture, outbreaks, earthquakes, and correlation | Refine a regional brief, watch dependencies, and request specialist review |
| Personal communications | Tactical Comms, Family Tracker, operator-selected SMS or Signal channel | Place-aware status templates, check-in windows, fallback ladders, and compact share codes | Review, send, confirm receipt, and escalate to the next planned channel |
Availability varies by geography, provider, rate limit, and configuration. Some services require an operator-supplied API key stored through macOS Keychain. Crystal Ball exposes feed health and timestamps so unavailable or stale coverage can be treated as an explicit analytical gap.
Quick start // real app
A field guide to Crystal Ball.
Three real screens show the fastest path from first launch to a working intelligence setup. No staged mockups and no credentials on display.
Read the live picture
Start in the operational view. Filter the triage rail by weather, conflict, cyber, health, infrastructure, or space, then use the map and situation cards to move from signal to context.
Tip // select a layer to reduce noise
Build your workspace
Open Library to browse the full panel catalog by mission: personal safety, analysis, conflict, markets, hazards, cyber, health, system status, and more. Search by panel name or tag when you already know what you need.
Library // choose panels by mission
Tune the system
Open Settings from the Crystal Ball menu. General controls live map and learning behavior; the remaining tabs organize panels, sources, API keys, thresholds, saved places, and system options.
Privacy // keys stay in macOS KeychainAnalytic note // interface assessment
What Crystal Ball is designed to do.
This assessment examines how Crystal Ball structures collection, triage, synthesis, and review. It evaluates the analytical design visible in the shipping interface—not the truth of any individual feed, forecast, or event.
Decision support with visible seams.
Crystal Ball is organized around a defensible intelligence principle: preserve the seams between collection, correlation, assessment, and action. The interface attempts to make sources, latency, corroboration, calibration, and operator choices inspectable instead of collapsing them into a single authoritative-looking answer.
Horizon scanning, prioritization, hypothesis generation, situational awareness, and structured review across multiple public-source domains.
The interface can improve analytical discipline, but it cannot guarantee source independence, eliminate collection bias, or convert incomplete reporting into certainty.
Findings from the interface and operating model.
Multi-domain sensemaking is the primary design objective.
The product is optimized for relationships among signals—not consumption of a single feed. Its value increases when developments in weather, conflict, infrastructure, health, markets, and logistics must be interpreted together.
Traceability is treated as an analytical control.
Source selection, validation states, update age, outcome review, and calibration remain visible. This gives an analyst several opportunities to challenge an assessment before it becomes a decision.
Configuration is part of the method, not cosmetic preference.
Panels, sources, places, thresholds, and operating modes define what the analyst can see and what is allowed to compete for attention. A workspace therefore expresses standing intelligence requirements.
Local-first design narrows—but does not erase—the trust boundary.
On-device processing and Keychain storage reduce routine credential exposure. Optional external providers still introduce their own data-handling terms and should be treated as explicit boundary crossings.
An explicit analytic workflow.
The strongest use of Crystal Ball follows a repeatable cycle in which every stage produces a question for the next.
Define the decision, geography, time horizon, and indicators that would change the judgment.
Select sources and panels for coverage, independence, freshness, and relevance—not volume alone.
Look for agreement across time, location, and domain while checking whether reports share one origin.
Review counter-evidence, confidence, calibration, data gaps, source incentives, and alternative explanations.
Separate facts from judgments, state uncertainty, document assumptions, and define the next observable change.
| Level | Meaning | Analyst action |
|---|---|---|
| Raw report | One publication, sensor reading, or observation. | Establish provenance, age, access, and possible incentive. |
| Signal | A normalized indicator extracted from one or more reports. | Check schema, freshness, duplication, and geographic fit. |
| Corroborated event | Evidence agrees across sources or domains. | Test source independence and seek disconfirming evidence. |
| Assessment | An analytic judgment about meaning, risk, or likely direction. | State confidence, assumptions, alternatives, and information gaps. |
| Decision support | A prioritized implication tied to an operator’s requirement. | Define action, owner, threshold, and indicators for revision. |
Severe weather at a logistics node.
This example shows how an analyst could move through the system when an extreme-weather alert appears near a port or distribution corridor. It demonstrates method; it does not describe a specific real-world incident.
Register the signal
Use triage and the map to establish severity, location, age, and the original issuing authority.
Define exposure
Identify nearby transport, power, population, health, and infrastructure dependencies.
Test independence
Compare local, official, and specialist reporting while tracing whether outlets share one source.
Estimate implications
Examine shipping, supply-chain, market, and resilience panels for second-order effects.
Set revision points
Brief what is known, state confidence, and define thresholds that would change the assessment.
Output // a bounded assessment with explicit evidence, uncertainty, exposure, and monitoring criteria—not a prediction presented as fact.
What stays local—and what may cross the boundary.
The architecture favors local processing and operating-system credential storage. The exact boundary still depends on which public feeds and optional providers the operator enables.
Reporting, sensors, feeds, and other network data enter the collection layer.
Collection, correlation, local AI workflows, panels, and operator review occur in the desktop app.
Selected requests may leave the Mac when the operator enables an external service.
Credentials // stored through macOS Keychain and kept out of the visible interface and project files.
Local-first // reduces routine exposure; it does not make network data or enabled providers local.
Operator responsibility // provider terms, retention, and transmitted fields should be reviewed before connection.
Feature tour // live screens
An analyst’s reading of the system.
The following plates document the running macOS application as an intelligence system rather than a collection of screens. Each view is examined for its operational purpose, analytical value, and limits of interpretation.
A multi-domain operating picture
The intelligence grid is the principal synthesis surface. It places maritime movement, public health indicators, personal resilience, supply-chain conditions, breaking reporting, and regional briefs within a common field of view. The objective is not simply density. It is analytical adjacency: preserving enough context for an operator to recognize when developments in one domain may alter the significance of another.
Analytical value
Cross-domain monitoring is most useful when second-order effects matter. A severe weather event may become strategically relevant when it coincides with port congestion, fragile infrastructure, or a deteriorating health signal. The grid supports this kind of comparison without forcing the analyst to abandon the wider picture.
Interpretation note
Proximity on the screen does not establish causation. Each panel should be read as a bounded evidence stream with its own update cadence, coverage, and uncertainty. The grid is a hypothesis-generation environment; source review remains necessary before judgment.
- Best used for horizon scanning and identifying cross-domain convergence
- Live reporting remains adjacent to structured indicators and regional context
From detection to defensible triage
The Threat Dashboard converts a high-volume alert stream into a prioritization problem. Severity, recency, distance, relevance, corroboration, and watchlist context are presented together so the operator can distinguish an urgent signal from a merely active one. The design favors explicit ranking criteria over a single opaque urgency score.
Operational use
Analysts can narrow the queue by proximity or severity, acknowledge items already reviewed, and use watchlists and playbooks to connect an alert with standing requirements. Playbooks make the response logic legible by showing which indicators contributed to an escalation state.
Interpretation note
A “verified” marker indicates that the system found supporting evidence or passed an internal validation rule; it should not be treated as a substitute for primary-source confirmation. The dashboard is a triage instrument intended to guide attention, not a final adjudication layer.
- Sort by relevance, severity, time, distance, and proximity
- Use playbooks to examine why a situation crossed an escalation threshold
Audit the machinery behind the assessment
The risk and calibration view treats analytical quality as an observable system property. Regional severity matrices sit beside prediction accuracy, source status, outcome records, and bias checks. This makes it possible to inspect not only what the system believes, but whether the process producing that belief is performing within acceptable bounds.
Analytical value
Calibration is essential when forecasts influence prioritization. The workbench exposes base rates, resolved labels, scoring loss, and high-confidence misses so an analyst can distinguish a well-calibrated warning process from one that is merely assertive. Safety-review states surface cases where performance has fallen below a defined floor.
Interpretation note
Small outcome samples and uneven regional coverage can make precise-looking metrics unstable. The correct response is to widen uncertainty, examine the underlying cases, and avoid treating a heat-map cell or percentage as independently conclusive.
- Regional matrices separate weather, seismic, health, cyber, and related risk
- Calibration, outcomes, and bias panels expose model performance and failure modes
Define the analytical workspace
The panel-control surface functions as a lightweight mission configuration layer. Rather than requiring every operator to inherit the same dashboard, it allows the visible workspace to be narrowed to the questions at hand: strategic risk, live intelligence, regional reporting, infrastructure, health, maritime activity, or personal resilience.
Operational use
A focused workspace reduces attentional competition and makes handoffs more consistent. Categories provide a stable taxonomy, while search supports rapid retrieval when the analyst already knows the panel required. Individual panels can be enabled or removed without rebuilding the broader application layout.
Interpretation note
Panel selection governs what is visible to the operator; it does not by itself establish collection quality or analytical priority. A clean workspace is useful only when its configuration reflects explicit intelligence requirements rather than convenience.
- Filter the catalog by core, intelligence, region, markets, and other missions
- Use the configuration as a documented expression of standing requirements
Make collection policy visible
The source-control view exposes the reporting universe entering the signal mesh. Sources can be searched, filtered by geography, and enabled or disabled individually. This turns collection from an invisible backend assumption into a reviewable policy decision that an analyst can revisit as requirements, trust judgments, or regional priorities change.
Analytical value
Visible source governance helps identify geographic blind spots, overreliance on a single reporting ecosystem, and duplicate coverage that may create a false impression of corroboration. Regional filters support a deliberate balance between local reporting, international outlets, research institutions, and open-source intelligence.
Interpretation note
Inclusion is not endorsement, and numerical source diversity is not the same as independent confirmation. Analysts should consider ownership, syndication, collection method, publication incentives, and the possibility that several outlets ultimately depend on the same original report.
- Region filters make coverage, concentration, and blind spots easier to audit
- Collection choices remain separate from credentials stored in macOS Keychain
02 // Signal over noise
Global awareness without surrendering your attention.
Crystal Ball brings fragmented public information into a single calm interface. Its desktop architecture keeps API keys in the macOS keychain, supports local AI first, and makes the source available for anyone to inspect.
Explore the architecture on GitHub ↗Local-first
Start with on-device intelligence and keep credentials out of the interface.
Source-aware
Trace signals back to their origins and distinguish reporting from assessment.
Open source
Inspect the code, contribute improvements, or build on the project under AGPL-3.0.
FAQ
Private by design.
The short version: Crystal Ball is an open-source Mac app, your keys stay yours, and local intelligence comes first.
Does Crystal Ball require an account?
No. Crystal Ball is designed to work without a Crystal Ball account or behavioral tracking.
Where are provider credentials stored?
API keys are stored using macOS Keychain credential storage, outside the app's interface and project files.
Does AI processing leave my Mac?
Local-first on-device AI is the default direction. Optional provider features depend on the services you choose to connect.
Can I inspect or contribute to the code?
Yes. The source is public on GitHub and licensed under AGPL-3.0.
Can Crystal Ball tell me when to evacuate or shelter?
Crystal Ball can surface and contextualize official warnings, nearby hazards, and infrastructure conditions, but it is not an emergency authority. Follow local emergency management, fire, weather, public-health, and law-enforcement instructions; call emergency services when danger is immediate.
Does Crystal Ball send SMS notifications automatically?
Not in the current alpha. Tactical Comms, Family Tracker, and Alert Family prepare structured SMS-ready messages and copy them to the clipboard. You choose the recipient, review the message, and send it through Messages, Signal, or another available channel. This prevents an unfinished alerting system from contacting people without confirmation.
Does Crystal Ball make investment decisions?
No. Market panels, watchlists, filings, macro data, and cross-domain analysis support research. They are not investment advice, trade execution, or a substitute for current source data and qualified professional judgment.
03 // Keep the signal alive
Independent software needs independent support.
Sponsorship helps cover data services, development time, testing, and the infrastructure that keeps Crystal Ball useful. If the project helps you see the world more clearly, help keep it moving.