Say "orbit the tower and come back." The agent maps it to one whitelisted command and posts it to a safety bridge — geofence, altitude ceiling, battery and take-off confirmation all enforced server-side. Try it below, no hardware needed.
No raw stick input, ever. The agent can only pick from a fixed command whitelist, and the bridge is the last word on whether any of them is allowed to run.
"Orbit the north tower at 40 m and film it, then come home."
The Bankr skill reads /state and turns your words into one whitelisted command.
Geofence, altitude, battery, GPS fix and take-off confirmation — pass or it returns 422.
Only approved commands reach the aircraft. Return-to-home is always the safe fallback.
Not in the prompt, not in the agent — in code, server-side. Six hard limits every flight command must clear.
Every target point must sit inside a radius around home (default 500 m). Out-of-fence → 422.
No command may exceed the configured max altitude (default 120 m).
Below the safe threshold, only return-to-home is permitted.
Leaving the ground requires an explicit confirm:true. No accidental launches.
Every action first checks online status and GPS fix, or it stops.
Anything ambiguous or unsafe resolves to return-to-home and land on the Dock.
The agent can only ever send one of these. There is no raw-control path — it doesn't exist by construction.
| Action | Parameters | What it does | Gated by |
|---|---|---|---|
get_state | — | Battery, GPS, altitude, geofence status. | always safe |
takeoff | confirm, alt_m | Ascend to a safe hover. | confirm + battery + altitude |
goto | lat, lon, alt_m | Fly to a point. | geofence + altitude |
orbit | radius_m, alt_m | Circle the current point (filming). | geofence + altitude |
set_altitude | alt_m | Climb or descend. | altitude ceiling |
capture_photo | — | Take a still. | safe (no flight) |
start_recording | — | Start video. | safe (no flight) |
return_to_home | — | Fly back and land on the Dock. | the safe fallback |
The exact same flight model and safety logic the bridge runs, ported to your browser. Fly the missions, then hit "fly 2 km" and watch the geofence refuse it.
Green = accepted by the bridge. Red = refused (HTTP 422) by a safety gate. Identical contract, identical refusals over real hardware.
The simulator above runs in-browser. To drive a real DJI Dock, run the bridge near it — the HTTP contract and every safety gate stay identical.
git clone https://github.com/richard7463/bankr-dji-drone
cd bankr-dji-drone
pip install -r bridge/requirements.txt
# 1) Simulator mode — zero hardware
export BRIDGE_TOKEN=$(openssl rand -hex 24)
export DRONE_MOCK=1
uvicorn bridge.server:app --host 0.0.0.0 --port 8080
# → open http://localhost:8080/
# 2) Real Dock — drop the mock, add DJI Cloud API creds
export DRONE_MOCK=0
export DJI_CLOUD_APP_KEY=... DJI_CLOUD_APP_SECRET=...
export GEOFENCE_RADIUS_M=500 MAX_ALT_M=120
uvicorn bridge.server:app --host 0.0.0.0 --port 8080