Building an Investment Intelligence Stack with AI Agents

Markets are information processing machines, but they’re inefficient at pricing rare, high-impact geopolitical events. Not because the information is secret — most of it is public — but because continuous monitoring at scale is tedious for humans. This creates an opportunity: automate the surveillance layer and surface anomalies before they’re priced in.

This article documents the investment intelligence stack I built using AI agents, OSINT feeds, and cron jobs. The focus is the system architecture, not trading advice. No position sizes, no specific recommendations — just the machinery.

The Thesis: Geopolitical Risk Is Underpriced

Traditional portfolio analysis focuses on company fundamentals, sector rotation, and technical indicators. This misses the tail risk: geopolitical shocks that move entire markets. Examples:

  • Russia invades Ukraine → energy spike, NATO spending up
  • Middle East escalation → oil volatility, safe-haven flows
  • US-China tech export controls → semiconductor supply chains disrupted

These events have lead indicators. Satellite imagery shows troop buildups. Shipping data reveals supply chain bottlenecks. Social media chatter from insiders leaks before official announcements. The challenge isn’t finding signals — it’s monitoring hundreds of sources continuously and filtering noise from signal.

Human analysts can’t do this at scale. You can’t read 50 OSINT feeds, check 20 prediction markets, and scan 100 Twitter accounts every 4 hours while also working a day job. But an AI agent can.

The Four-Indicator Dashboard

The system tracks four composite indicators, each pulling from multiple data sources:

1. Arc Reactor Index (1-5 scale)

This is an analytical proxy for global stability, inspired by Tony Stark’s power source metaphor. It aggregates:

  • Superpower posture changes (US carrier deployments, Russian strategic bomber activity)
  • Nuclear-relevant events (uranium prices, IAEA reports, weapons testing)
  • Defense industrial indicators (Lockheed/Raytheon/Northrop order backlogs)
  • Strategic materials pricing (titanium, rare earths, semiconductor-grade silicon)

The agent scores each sub-indicator, weights by historical correlation to market moves, and outputs a 1-5 number. 1 = stable, 5 = hot conflict risk elevated. The score updates daily at 6 AM.

2. DOUGHCON Level

The real-world DOUGHCON system tracks pizzeria orders near defense and intelligence facilities as a proxy for operational tempo. I use data from pizzint.watch (a public pizza monitoring service that crowdsources orders from shops near military bases).

The logic: when Pentagon pizza orders spike 30% above baseline on a weekend, something operational is happening. Could be a drill, could be a crisis. Either way, markets often don’t notice until Monday.

The agent scrapes pizzint.watch every 4 hours, calculates z-scores for each tracked location, and flags anomalies. A sustained 2-sigma spike triggers an alert to #stark-industries Slack channel.

3. Nothing Ever Happens Index

This is a contrarian indicator. When social media is flooded with panic about an imminent crisis, markets often… do nothing. The crowd overreacts, then the event fizzles. The “Nothing Ever Happens” meme captures this.

The agent tracks Twitter/X accounts known for geopolitical commentary (analysts, journalists, OSINT aggregators), measures sentiment and urgency keywords (“imminent,” “unprecedented,” “sources say”), and calculates a composite panic score. High panic + no price movement = potential mean reversion opportunity. High panic + price movement = trend confirmation.

Updated every 6 hours. Mostly useful as a sanity check — when this index is pegged at max, fade the panic.

4. Polymarket Odds

Prediction markets aggregate crowd forecasts. I track specific questions:

  • “Will [country X] and [country Y] be in armed conflict by [date]?”
  • “Will oil close above $100 before [date]?”
  • “Will the Fed cut rates at the next meeting?”

The agent fetches current odds every 4 hours via Polymarket’s API, calculates rate-of-change (rapid odds swings indicate new information flow), and compares to historical implied probabilities.

When Polymarket odds diverge sharply from options-implied probabilities (e.g., Polymarket says 60% chance of conflict but SPY put skew is only pricing 30%), that’s a potential arbitrage or mispricing.

OSINT Source Stack

The system ingests data from multiple open-source intelligence feeds:

PizzINT Ecosystem: Real-time pizza delivery tracking near defense facilities (pizzint.watch, PizzaWatch Twitter account). Sounds meme-ish, but has historically led market-moving events by 6-24 hours.

Twitter/X Accounts: Curated list of 40+ accounts including defense analysts, satellite imagery specialists, and supply chain trackers. The agent uses embeddings to cluster topics and detect emerging narratives before they hit mainstream news.

GDELT (Global Database of Events, Language, and Tone): Free dataset updated every 15 minutes with global news coverage. The agent queries for keywords like “military mobilization,” “trade embargo,” “sanctions,” and tracks mention frequency spikes.

NASA FIRMS (Fire Information for Resource Management System): Satellite-detected thermal anomalies. Useful for tracking industrial activity (oil refineries on fire), military activity (cruise missile strikes), and environmental events (pipeline explosions). Updated every 3 hours.

Shipping Data (AIS): Automatic Identification System broadcasts from commercial vessels. Free access via VesselFinder API. Tracks oil tanker routes (Mideast → Europe blockage risk), LNG shipments (Europe energy security), and bulk carriers (commodity flow indicators).

Reddit Geopolitical Subs: r/geopolitics, r/CredibleDefense, r/OSINT. The agent summarizes top posts daily, flags high-engagement discussions, and extracts sourced claims for verification.

Energy Grid Data: Public APIs from grid operators (ERCOT, CAISO, ENTSO-E) showing real-time power demand and generation mix. Sudden shifts can indicate industrial activity changes or grid stress.

The agent doesn’t just scrape these sources — it correlates them. If NASA FIRMS shows thermal anomalies near a Russian military base AND pizza orders spike in Fort Meade AND defense Twitter is buzzing about “[redacted country] posture change,” that’s a stronger signal than any one indicator alone.

Cron Job Architecture

The system runs on a Mac Mini with four cron job types:

Morning Briefing (daily, 6:00 AM)

Runs a comprehensive scan of all indicators:

  1. Fetch overnight news (GDELT query for geopolitical keywords)
  2. Update Arc Reactor Index (recalculate sub-indicators from APIs)
  3. Check DOUGHCON levels (pizzint.watch scrape + z-score calculation)
  4. Calculate Nothing Ever Happens Index (Twitter sentiment analysis)
  5. Refresh Polymarket odds (fetch API, compute rate-of-change)
  6. Generate summary report with flags for anomalies

Output posted to #stark-industries Slack channel. Typical report length: 400-800 words, 2-4 charts embedded.

4-Hour Scanner (every 4 hours, 24/7)

Lightweight continuous monitoring:

  1. Check for DOUGHCON spikes (new pizza orders above threshold)
  2. Scrape Twitter for breaking geopolitical news (keyword alerts)
  3. Update Polymarket odds (detect rapid swings)
  4. Query NASA FIRMS for new thermal anomalies

If any threshold is breached, post immediate alert to Slack. Otherwise, log to database silently for morning briefing aggregation.

Weekly Digest (Sunday, 8:00 PM)

Retrospective analysis:

  1. Review past week’s Arc Reactor Index trend (did it correctly predict Monday volatility?)
  2. Calculate prediction accuracy (did flagged Polymarket divergences resolve profitably?)
  3. Identify false positives (alerts that didn’t lead to market moves)
  4. Generate calibration report (are indicator thresholds tuned correctly?)

This is for system improvement, not trading. The goal is to continuously refine which signals actually matter.

VIX Daily (weekdays, 4:15 PM after market close)

Special focus on volatility:

  1. Fetch VIX close, calculate daily change
  2. Compare to Arc Reactor Index (did elevated geopolitical risk predict VIX spike?)
  3. Check put/call skew across SPY, QQQ, IWM (is options market pricing tail risk?)
  4. Flag divergences (VIX low but geopolitical indicators elevated = potential mismatch)

This runs separately because VIX is the market’s “fear gauge” — it’s the closest thing to a real-time geopolitical risk price.

Example Morning Briefing Output

Here’s a sample of what the system produces (anonymized, no specific dates):

MORNING INTELLIGENCE BRIEF — 2026-XX-XX

ARC REACTOR INDEX: 3.2 (+0.3 from yesterday)
- US carrier movements detected in [region] (OSINT confirmation)
- Defense contractor order backlog up 8% QoQ (10-Q filings)
- Uranium spot price +4% this week (TradeTech data)
Assessment: Moderate escalation risk, monitor for sustained trend

DOUGHCON STATUS: Level 2 (ELEVATED)
- Fort Meade pizza orders +22% vs 30-day avg (pizzint.watch)
- Langley baseline, no anomaly
- Colorado Springs +15% (within normal variance)
Interpretation: Possible CYBERCOM activity or drill, not actionable alone

NOTHING EVER HAPPENS INDEX: 6.8/10 (FADING ZONE)
- Twitter panic elevated re: [event X], 240+ posts in 6h
- Mainstream media coverage lagging (CNN/Bloomberg no coverage)
- Historical pattern: 70% of events at this index level resolve as non-events
Interpretation: Crowd overreacting, consider fade if market gaps up on Monday

POLYMARKET WATCH:
- "[Event Y] by [date]" market: 42% → 58% in 18 hours (volume spike)
- SPY put skew implies only 30% tail risk (divergence detected)
- Suggested action: Monitor for convergence or arbitrage opportunity

THERMAL ANOMALIES (NASA FIRMS):
- [Location Z]: new heat signature detected, consistent with industrial fire
- Cross-reference: AIS shows no tanker diversions yet (no supply impact priced)
- Status: Watch-list, not actionable until shipping data confirms

MARKET CORRELATION CHECK:
- VIX closed 16.2 (-0.3) despite Arc Reactor Index +0.3
- Interpretation: Market not pricing elevated geopolitical risk yet

The briefing doesn’t say “buy X” or “sell Y.” It surfaces anomalies and correlations. The human (me) makes trading decisions based on this plus other analysis.

Channel Routing

All investment intelligence output goes to #stark-industries, a dedicated Slack channel. This keeps it separate from general engineering discussions. The Mac Mini agent owns this channel (as described in the multi-channel routing architecture).

The channel has:

  • Morning briefing (daily summary)
  • 4-hour scanner alerts (immediate notifications for threshold breaches)
  • Weekly digest (system calibration report)
  • VIX daily (post-market volatility check)

By consolidating into one channel, I can review all intelligence in a single place. No scattered alerts across email, SMS, or multiple Slack channels.

How It Works in Practice

A typical workflow:

  1. 6 AM: Morning briefing posts to Slack. I skim it over coffee. Arc Reactor Index elevated, DOUGHCON normal, Polymarket shows divergence on [event X].

  2. 10 AM: Market opens. I check if VIX is reacting to Arc Reactor signals. If not, I flag this as potential underpricing.

  3. 2 PM: 4-hour scanner fires alert: DOUGHCON spike detected at Fort Meade. Twitter chatter confirms “unscheduled Pentagon meeting.” No price movement yet in defense stocks.

  4. 3 PM: I check options chain on SPY and LMT (Lockheed Martin). Put skew hasn’t moved. Market isn’t pricing this yet.

  5. 4:15 PM: VIX daily report confirms: VIX flat despite multiple geopolitical indicators elevated.

  6. Decision point: Do I act on this information? That’s a human judgment call — not automated. The system provides signal aggregation, not execution.

The key: the system runs 24/7, monitoring dozens of sources, so I don’t have to. It compresses hours of manual research into a 5-minute Slack review.

What This Is NOT

This system does NOT:

  • Execute trades automatically (no algorithmic trading)
  • Provide specific buy/sell recommendations
  • Guarantee profitability (it’s a monitoring tool, not a crystal ball)
  • Replace fundamental analysis (I still read 10-Ks and earnings calls)
  • Handle risk management (position sizing and stops are separate systems)

It’s an intelligence layer, not a trading system. Think of it as a research assistant that never sleeps.

Technical Stack

  • Compute: Mac Mini (2026 M4 Pro), always-on, local execution
  • Language: Python 3.11 for scrapers, Claude API for NLP/summarization
  • Data Storage: PostgreSQL for time-series indicator data, flat files for logs
  • Scheduling: macOS cron jobs (simple, reliable, no external dependencies)
  • APIs: Polymarket (prediction markets), GDELT (news events), NASA FIRMS (thermal data), VesselFinder (shipping), Twitter/X (OSINT)
  • Slack Integration: Custom bot using Slack SDK, posts to #stark-industries channel
  • AI Agent: Claude Code instance running on Mac Mini, with memory persistence for indicator calibration

Total cost: ~$50/month (APIs + Claude usage). No cloud hosting fees since it’s all local.

Lessons Learned

Signal decay: Some indicators that worked in 2024 stopped working in 2025. Example: DOUGHCON was highly predictive for 8 months, then went noisy. Cause: more people discovered pizzint.watch, orders got “poisoned” by observers. Solution: weekly calibration reports let me detect and deprecate stale indicators.

False positive rates: Early versions had too many alerts. Every pizza spike triggered a notification. I added threshold tuning: only alert if z-score > 2.0 AND sustained for 2+ readings (8 hours). This cut false positives by 70%.

Latency matters: Originally ran morning briefing at 8 AM. By then, market premarket was already moving. Moved to 6 AM to give myself 3.5 hours before market open.

Correlation ≠ causation: Just because Arc Reactor Index and VIX sometimes move together doesn’t mean one predicts the other. The system flags divergences, but I still need to reason about causality before trading.

Operational security: The Slack channel is private. I don’t share raw intelligence on public Twitter/Reddit because (a) don’t want to move markets with crowdsourced panic, and (b) don’t want to telegraph positions to adversarial traders.

Future Enhancements

Satellite imagery integration: Currently rely on Twitter analysts for satellite OSINT. Could add direct Planet Labs API access for automated change detection (e.g., troop movements, oil storage capacity).

Options flow scraping: Unusual options activity (large whale trades) can signal insider information. Could add UnusualWhales API to correlate with geopolitical indicators.

LLM-based scenario generation: When multiple indicators spike simultaneously, have the AI generate “what if” scenarios with probabilistic branching (e.g., “If [event X] escalates, 60% chance oil spikes, 30% chance diplomatic resolution, 10% chance…”).

Backtesting engine: Retroactively test if past indicator readings would have predicted market moves. Requires historical database of indicators + market data. Would improve calibration.

Multi-asset monitoring: Currently focused on equities/VIX. Could expand to oil futures, gold, Bitcoin (risk-on/risk-off flows), and currency pairs (safe havens like JPY/CHF).

Conclusion

Markets underprice rare geopolitical risk because continuous monitoring is expensive for humans. An AI-powered OSINT aggregation system automates the surveillance layer, compressing hours of manual research into minutes of signal review.

The architecture is straightforward: cron jobs scrape public data sources, AI agents correlate indicators, anomalies get flagged in a dedicated Slack channel. No black-box models, no proprietary data — just systematic aggregation of open-source intelligence.

This is not a trading system. It’s an intelligence system. The human still makes decisions, but the AI ensures no signal is missed due to attention limits or time constraints.

If you’re building something similar, key principles:

  • Start with free/cheap APIs, validate signals before paying for premium data
  • Use cron jobs for scheduling (simple, no external orchestration dependencies)
  • Consolidate output into one channel to minimize context-switching
  • Calibrate continuously (indicators decay, thresholds need tuning)
  • Never automate execution (intelligence ≠ trading decisions)

The edge isn’t in having better data — most of this is public. The edge is in systematic, tireless aggregation and anomaly detection that humans can’t sustain manually.