198 sensor sources → Mamba-2 state compression → intuition emergence → BFT council decision → SIGIL-signed action. Seven stages. Sub-40-second lead time on emerging threats.
Satellite, AIS, ADS-B, OSINT, IoT, social, radio — all ingested simultaneously
Noise → Filter → Frequency → Correlate → Intuition → Council → Action
Average time from first signal to confirmed intuition — before conscious analysis
Mamba-2 SSM compresses all history into a fixed 16-dim state vector
Raw multi-domain sensor data enters at Stage 1. By Stage 7, a SIGIL-signed action has been taken. The pipeline runs 24/7, processing 198+ streams in parallel. No human bottleneck until the final action authorisation.
Every signal, every sensor, every feed. Satellite imagery (Sentinel-Hub), maritime AIS (aisstream.io), aircraft ADS-B, OSINT (GDELT), air quality (OpenAQ), government data (data.gov.uk, ONS, Companies House), IoT (MQTT bridges), IP cameras (RTSP), radio frequency, social media. All ingested via 30 MCP servers running in parallel. Zero data leaves UK sovereign infrastructure.
Raw noise is filtered through domain-specific experts. PII redacted (GDPR). Duplicates removed. Timestamps normalised to UTC. Geospatial coordinates converted to MGRS. Each signal tagged with source, confidence, and timestamp before entering the state vector.
14 neural models process all filtered signals simultaneously. Each model looks for different patterns: temporal clustering, spatial anomalies, cross-domain correlations, behavioural baselines, frequency shifts. The Mamba-2 state-space model compresses the entire signal history into a 16-dimensional state vector at each timestep.
The intelligence fusion layer. Signals from disparate domains are cross-correlated. AIS anomaly + satellite imagery change + OSINT keyword spike = correlated event. The Mamba-2 state vector captures these correlations even when no single signal would trigger an alert in isolation.
The system FEELS something is wrong before it can explain why. When the 16-dim state vector shifts beyond a cosine similarity threshold (Δ > 0.85), a "hunch" is flagged. If 3+ consecutive states match the pattern, intuition is confirmed. This gives operators a 40-second lead time — the pattern is detected before conscious analysis can articulate the threat.
Confirmed intuitions are escalated to the 33-node BFT council. Each node evaluates from its specialisation: charter compliance, security, data sovereignty, ethics, mission priority, intelligence correlation. 22-of-33 must agree before action is authorised. Every vote is SIGIL-emitted for audit.
Approved actions are executed. Every action generates an Ed25519-signed SIGIL receipt on the hash chain. Results are fed back into the system — the Mamba-2 state updates, the MoE experts learn, the council's decision quality improves. The pipeline gets smarter with every cycle.
DEFONEOS doesn't buy data from foreign intelligence brokers. It ingests from 30 open-source and sovereign MCP servers, each wrapping a live data feed. All processing happens on UK infrastructure.
| MCP Server | Domain | Feed | Update Rate |
|---|---|---|---|
sentinel-hub-mcp | Satellite | Sentinel-1/2/3, Landsat, MODIS imagery | Every orbit (~90 min) |
os-opendata-mcp | Geospatial | Ordnance Survey MasterMap, terrain, roads | Daily |
data-gov-uk-mcp | Government | Government open data (transport, health, environment) | Hourly |
companies-house-mcp | UK company filings, directorships, PSCs | Daily | |
ons-statistics-mcp | Demographics | ONS census, economic indicators, population data | Daily |
gdelt-news-mcp | OSINT | GDELT global news events (3,000+ sources) | Every 15 min |
openaq-air-mcp | Environmental | Global air quality monitoring (PM2.5, NO2, O3) | Hourly |
aisstream-maritime-mcp | Maritime | Global AIS vessel positions (real-time) | Continuous |
adsb-aircraft-mcp | Aerospace | Global aircraft ADS-B transponder feeds | Continuous |
rtsp-camera-mcp | Visual | IP camera / RTSP stream ingestion + YOLOv8 detection | Per frame |
mqtt-bridge-mcp | IoT | MQTT sensor networks (temperature, pressure, motion) | Per event |
openmeteo-weather-mcp | Meteorology | Open-Meteo weather forecasts + historical data | Hourly |
openstreetmap-mcp | Mapping | OSM tiles, routing, POIs, infrastructure | On demand |
earthquake-usgs-mcp | Seismic | USGS global earthquake monitoring | Continuous |
nhs-trust-mcp | Healthcare | NHS Trust locations, capacity, services | Daily |
defoneos-counterdrone-mcp | C-UAS | RF detection + Batear acoustic sensor integration | Continuous |
defoneos-freetak-mcp | C2 | FreeTAKServer CoT (Cursor on Target) protocol bridge | Per event |
defoneos-medevac-mcp | Medical | MEDEVAC routing, casualty triage, hospital capacity | On demand |
defoneos-jsp936-mcp | Compliance | JSP 936 compliance assertion + certificate generation | Per action |
defoneos-cyber-mcp | Cyber | Threat detection, vulnerability scanning, STRIDE | Continuous |
+ 10 more MCP servers covering logistics, supply chain, edge computing, quantum tools, and civil service integration.
The DEFONEOS ISR pipeline maps directly to the standard intelligence cycle and the F2E2D2 kill chain — but compressed from hours to seconds through automation.
| Traditional Stage | Traditional Time | DEFONEOS Stage | DEFONEOS Time | Speedup |
|---|---|---|---|---|
| Find (sensor tasking) | 30-60 min | Stage 1-2: NOISE → FILTER | <1s (always-on) | 1800x |
| Fix (geolocation) | 5-15 min | Stage 3: FREQUENCY (auto-geo) | <2s | 300x |
| Track (monitoring) | Continuous (manual) | Stage 3-4: Mamba-2 state tracking | Continuous (automated) | — |
| Target (identification) | 10-30 min | Stage 4-5: CORRELATE → INTUITION | <10s | 180x |
| Engage (decision) | 15-45 min (chain of cmd) | Stage 6: BFT COUNCIL | <30s | 60x |
| Assess (BDA) | 30-60 min | Stage 7: ACTION + learning loop | <5s | 360x |
Manual tasking → human analysis → chain of command → manual BDA
Always-on ingest → automated fusion → BFT council → SIGIL action
The pipeline runs continuously. Here is exactly how data flows from sensor to action:
The pipeline is fully configurable. Sensitivity, thresholds, and council rules can be tuned per deployment.
| Parameter | Default | Range | Description |
|---|---|---|---|
intuition_threshold | 0.85 | 0.5–0.99 | Cosine similarity delta for hunch detection |
intuition_confirm_matches | 3 | 1–10 | Consecutive matching states to confirm intuition |
bft_quorum | 22 | 17–33 | Council votes required to pass (out of 33) |
bft_timeout | 30s | 5–120s | Max deliberation time before forced vote |
mcp_ingest_parallel | 30 | 1–60 | Number of MCP servers polled in parallel |
mamba_state_dim | 16 | 8–128 | State vector dimensions (higher = more nuance, slower) |
pii_redaction | strict | strict/standard/off | GDPR PII redaction level on ingest |
airgap_mode | false | true/false | Disable all external MCPs — local sensors only |
sigil_auto_emit | true | true/false | Automatically SIGIL every action (audit requirement) |