- TypeScript 50.3%
- JavaScript 47.8%
- CSS 1.2%
- HTML 0.2%
- Shell 0.2%
- Other 0.1%
| Filename | Latest commit message | Latest commit date |
|---|---|---|
93846bdb40* docs(openapi): declare X-Trust-Review-Key on the error-report review operations
ListErrorReports and ReviewErrorReport skip the gateway API-key check
(PUBLIC_NO_AUTH_RPC_PATHS) and 401 in the handler without
X-Trust-Review-Key, but the generated spec published security: [] and
no 401. The security injector gains a third credential class: a
TrustReviewKey apiKey scheme, stamped per operation with a 401 that
references the handler's { message } Error body, on the JSON and the
surgical YAML paths. TRUST_REVIEW_KEY_PATHS is single-sourced in
scripts/lib/openapi-codegen.mjs; the injector fails closed if a path
leaves PUBLIC_NO_AUTH_RPC_PATHS or joins a bearer or public-403 source,
and the contract test checks the set against every operation whose
description names the header.
Fixes #9192
Claude-Session: https://claude.ai/code/session_01VWpKXJfGokgi1kLNig7cHC
* fix(openapi): drop unreferenced security schemes from the served JSON
The review-key operations are excluded from public/openapi.json, so
TrustReviewKey shipped there as an orphan worth 243 bytes of the
scanner budget. buildBundle now drops any scheme no security entry
names. The contract test also counts isTrustReviewer call sites against
TRUST_REVIEW_KEY_PATHS, and the 401 description covers an unset
TRUST_REVIEW_SECRET.
Claude-Session: https://claude.ai/code/session_01VWpKXJfGokgi1kLNig7cHC
|
||
| .agents/skills | ||
| .audit | ||
| .github | ||
| .husky | ||
| api | ||
| blog-site | ||
| cli | ||
| consumer-prices-core | ||
| convex | ||
| data | ||
| demos/verification-desk | ||
| deploy/nginx | ||
| docker | ||
| docs | ||
| e2e | ||
| pro-test | ||
| proto | ||
| public | ||
| scripts | ||
| sdk | ||
| server | ||
| shared | ||
| skills | ||
| src | ||
| src-tauri | ||
| tests | ||
| vendor | ||
| workers | ||
| .dockerignore | ||
| .env.example | ||
| .gitattributes | ||
| .gitignore | ||
| .impeccable.md | ||
| .markdownlint-cli2.jsonc | ||
| .npmrc | ||
| .nvmrc | ||
| .vercelignore | ||
| AGENTS.md | ||
| ARCHITECTURE.md | ||
| biome.json | ||
| CHANGELOG.md | ||
| CODE_OF_CONDUCT.md | ||
| compound-engineering.local.md | ||
| CONCEPTS.md | ||
| CONTRIBUTING.md | ||
| country.html | ||
| docker-compose.yml | ||
| Dockerfile | ||
| Dockerfile.digest-notifications | ||
| Dockerfile.publish-bootstrap-tiers | ||
| Dockerfile.relay | ||
| Dockerfile.seed-bundle-portwatch-port-activity | ||
| Dockerfile.seed-bundle-resilience-validation | ||
| Dockerfile.umami | ||
| Dockerfile.umami-retention | ||
| embed.html | ||
| index.html | ||
| LICENSE | ||
| live-channels.html | ||
| Makefile | ||
| market.html | ||
| mcp-grant.html | ||
| mcp.json | ||
| middleware.ts | ||
| nixpacks.toml | ||
| package-lock.json | ||
| package.json | ||
| playwright.config.ts | ||
| plugin.html | ||
| plugin.json | ||
| README.ja-JP.md | ||
| README.md | ||
| README.ru.md | ||
| README.zh-CN.md | ||
| SECURITY.md | ||
| SELF_HOSTING.md | ||
| server.json | ||
| settings.html | ||
| tsconfig.api.json | ||
| tsconfig.contract-tests.json | ||
| tsconfig.dom-tests.json | ||
| tsconfig.json | ||
| vercel.json | ||
| verify.html | ||
| vite.config.ts | ||
| vite.plugin.config.ts | ||
| vitest.config.mts | ||
| vitest.dom.config.mts | ||
World Monitor
Real-time global intelligence dashboard — AI-powered news aggregation, geopolitical monitoring, and infrastructure tracking in a unified situational awareness interface.
-0078D4?style=for-the-badge&logo=windows&logoColor=white){kind=icon}
-FCC624?style=for-the-badge&logo=linux&logoColor=black){kind=icon}
Documentation · Releases · Contributing
What It Does
- Curated news feeds across global and regional categories, AI-synthesized into briefs
- Dual map engine — 3D globe (globe.gl) and WebGL flat map (deck.gl) with a shared map-layer catalog
- Panel inventory — concrete panel implementations across specialized variants
- Cross-stream correlation — military, economic, disaster, and escalation signal convergence
- Country Instability Index (CII) — live CII v8 scores, bands, and approximate 24-hour movement for 31 Tier-1 countries
- Finance radar — stock exchanges, commodities, crypto, and a market composite
- Local AI — run everything with Ollama, no API keys required
- Site variants from a single codebase (world, tech, finance, commodity, happy, energy)
- Native desktop app (Tauri 2) for macOS, Windows, and Linux
- Multilingual UI with native-language feeds and RTL support
For the full feature list, architecture, data sources, and algorithms, see the documentation.
Support Status
All site variants and desktop binaries are built from a single codebase and ship from the same release process. The table below clarifies maintenance status so you know which surfaces are safe to depend on.
| Surface | Status | Notes |
|---|---|---|
worldmonitor.app, tech., finance., commodity., happy., energy. |
Stable | Public deployments built from this repo, actively maintained |
| Desktop binaries (Windows / macOS Apple Silicon / macOS Intel / Linux AppImage) | Stable | One Tauri binary for every variant — install World Monitor and switch to tech, finance, commodity, energy, or happy in-app. There is deliberately no per-variant download |
Issues filed against any of the above are triaged from the same backlog — see the issues board for currently-open work.
Quick Start
git clone https://github.com/koala73/worldmonitor.git
cd worldmonitor
npm install
npm run dev
Open localhost:3000 (override the port with DEV_PORT in .env.local). The app runs with no environment variables.
Feature-specific data sources may require credentials. See .env.example for the full list.
For variant-specific development:
npm run dev:tech # tech.worldmonitor.app
npm run dev:finance # finance.worldmonitor.app
npm run dev:commodity # commodity.worldmonitor.app
npm run dev:happy # happy.worldmonitor.app
npm run dev:energy # energy.worldmonitor.app
See the self-hosting guide for deployment options (Vercel, Docker, static).
Tech Stack
| Category | Technologies |
|---|---|
| Frontend | Vanilla TypeScript, Vite, globe.gl + Three.js, deck.gl + MapLibre GL |
| Desktop | Tauri 2 (Rust) with Node.js sidecar |
| AI/ML | Ollama / OpenRouter, Transformers.js (browser-side) |
| API Contracts | Protocol Buffers and sebuf HTTP annotations |
| Deployment | Vercel Edge Functions, Railway relay, Tauri, PWA |
| Caching | Redis (Upstash), 3-tier cache, CDN, service worker |
Full stack details in the architecture docs.
Programmatic Access
World Monitor is built for agents and scripts as well as browsers:
-
MCP server —
https://worldmonitor.app/mcp(Streamable HTTP). Publictools/list;tools/callauthenticates with aX-WorldMonitor-Keyheader or OAuth. The server also publishes its Agent Skills through the draftio.modelcontextprotocol/skillsextension (skills/list,skills/get, andskill://…resource reads). -
REST API — base
https://api.worldmonitor.app, described by the OpenAPI spec. -
CLI — the official
worldmonitornpm package (source incli/):npx worldmonitor tools # run ad-hoc — list every MCP tool (no key needed) npm install -g worldmonitor # or install the `worldmonitor` (alias `wm`) command worldmonitor risk IR --api-key wm_xxx -
SDKs — official zero-dependency client libraries mirroring the CLI: Python
worldmonitor-sdk(source insdk/python/), Rubyworldmonitor(sdk/ruby/), Gogithub.com/koala73/worldmonitor/sdk/go(sdk/go/). Guide: worldmonitor.app/docs/sdks.
Agent discovery files: llms.txt · agent-skills manifest · api-catalog. Get an API key at worldmonitor.app/pro.
Flight Data
Flight data provided graciously by Wingbits, the most advanced ADS-B flight data solution.
Data Sources
WorldMonitor aggregates attributed upstream sources across geopolitics, finance, energy, climate, aviation, cyber, military, infrastructure, and news intelligence. Curated feeds and freshness-tracked source groups are published in the full data sources catalog, with provider, feed-tier, license-posture, and collection-method details.
Contributing
Contributions welcome! See CONTRIBUTING.md for guidelines.
npm run typecheck # Type checking
npm run build:full # Production build
License
AGPL-3.0-only for the source code. Commercial use is permitted under the AGPL when you comply with its copyleft and source-availability terms.
| Use Case | Allowed? |
|---|---|
| Personal / research / educational | Yes, under AGPL-3.0-only |
| Self-hosted instance | Yes, under AGPL-3.0-only |
| Fork and modify | Yes, share source under AGPL-3.0-only when required |
| Commercial use / SaaS | Yes, under AGPL-3.0-only when you comply with AGPL obligations |
| Private-source proprietary use or official branding rights | Separate commercial or trademark permission needed |
See LICENSE for the full code license and docs/license.mdx for a plain-language summary. Commercial licensing is available as an alternative option for teams that need non-AGPL terms.
Copyright (C) 2024-2026 Elie Habib. All rights reserved.
Author
Elie Habib — GitHub
Contributors
Security Acknowledgments
We thank the following researchers for responsibly disclosing security issues:
- Cody Richard — Disclosed three security findings covering IPC command exposure, renderer-to-sidecar trust boundary analysis, and fetch patch credential injection architecture (2026)
See our Security Policy for responsible disclosure guidelines.
worldmonitor.app · docs.worldmonitor.app · finance.worldmonitor.app · commodity.worldmonitor.app