World Monitor
A unified dashboard for monitoring global news, geopolitical risk, markets, and infrastructure.
The security policy gives concrete controls for privilege boundaries, read-only upstream access, RSS/MCP egress restrictions, IPC origin checks, short-lived session tokens, OS-keychain storage, and server-side secrets. Workflows generally declare narrow GitHub permissions, supporting full credit for least privilege and sensitive-data handling. Deductions remain because the supplied files do not show the actual user-confirmation UI or authorization behavior of every MCP tool; flows across 526 external providers and analytics depend on an unavailable documentation catalog; dependency overrides, security-floor scripts, and pinned Actions are present but no lockfile, audit result, or SBOM is supplied; draft releases reduce deployment risk but rollback for user data or configuration is undocumented; and source attribution is asserted through a catalog that is not included.
The README, package metadata, security policy, and desktop workflow broadly agree on versions, platforms, build modes, and principal security boundaries. Monitoring, rate limiting, circuit breakers, caching, and numerous static test commands are represented. Deductions apply because the product relies on hundreds of external feeds and several cloud services without a supplied degradation matrix or availability commitment, and the README's stability claims cannot be independently established by this static review. The unexplained consumer-prices-core tests also appear peripheral to the described product. Failure messaging is thorough: workflows issue actionable errors or warnings for missing secrets, mismatched tags, release overwrites, missing artifacts, crashes, and signing problems.
The evidence addresses browser use, six site variants, desktop platforms, CLI, REST, MCP, several SDK languages, 28 human languages, local Ollama, and multiple hosting paths, thoroughly covering audiences and environments. Capability boundaries and trigger precision lose points because the complete tool schemas, per-tool side-effect classifications, numeric rate limits, and consent state machine are absent. An MCP consent test is named in package scripts, but its name alone cannot establish precise behavior for all tools.
The README is organized around features, support status, setup, stack, programmatic access, sources, contribution, licensing, and maintenance. Installation commands are concrete, variant and package naming are stable, and the single desktop release line is explicitly enforced. AGPL-3.0-only metadata, the full license, the plain-language summary, the named maintainer, private reporting path, and response targets are strong. Deductions reflect that architecture, source, and self-hosting details reside in unavailable external documentation; examples are mostly quick-start and a few CLI calls with no substantive FAQ; known limitations are only partially covered by the DNS-rebinding residual discussion; and a version and release process exist without a supplied changelog.
The unified dashboard, map layers, cross-stream correlation, financial and infrastructure views, plus CLI, REST, MCP, and SDK access provide directly usable outputs and clear marginal value over a single-feed reader. Cost-benefit is not fully established: the base application and Ollama can run without keys, but complete functionality involves numerous external APIs, optional Pro access, edge functions, Redis, a desktop sidecar, and a complex build chain. The supplied evidence does not quantify latency, compute use, pricing, or the cost of false or noisy signals.
Many claims are tied to exact counts, component names, repository paths, scripts, issue numbers, or documentation entry points. Package metadata and workflows corroborate portions of the platform, version, security checks, and test surface. Deductions apply because the source catalog, algorithms, and generated artifacts behind the 500-plus feeds, 56 layers, CII v8, correlation analysis, and propaganda-risk ratings are not supplied; no independent source corroboration is present; and the files do not show how observed facts, model inference, AI summaries, and risk scores are distinguished in actual outputs.
- This assessment is limited to the supplied static excerpts; no build, test, dependency audit, desktop binary, or MCP call was executed.
- Before using the product for high-stakes geopolitical, financial, or security decisions, verify the source catalog, freshness, AI-summary provenance, scoring methods, and uncertainty labels.
- Before enabling hosted AI, Pro MCP, analytics, or third-party APIs, confirm each recipient, retention policy, cost, permission scope, and user-consent flow.
- The desktop workflow can build unsigned artifacts when Apple signing material is unavailable; verify signatures, checksums, and update provenance for the assets actually distributed.
- AGPL-3.0-only imposes source-availability obligations for modified network deployments; closed-source, SaaS, and official-brand uses require license and trademark review.
What does this agent do, and when should you use it?
World Monitor is a real-time global intelligence dashboard that brings news, geopolitical, military, disaster, economic, energy, and infrastructure signals into one situational-awareness interface. It aggregates more than 500 curated news feeds, synthesizes them into AI-generated briefs, and presents data through a globe.gl 3D globe, a deck.gl WebGL map, 56 map-layer types, and 109 implemented panels. A single codebase produces six variants—world, tech, finance, commodity, happy, and energy—plus Tauri 2 desktop binaries for Windows, macOS, and Linux. Programmatic access is available through a Streamable HTTP MCP server, REST API, OpenAPI specification, npm CLI, and official Python, Ruby, and Go SDKs. AI processing can use local Ollama or the documented Groq and OpenRouter options, while delivery paths include Vercel, Docker, static hosting, PWA, and native desktop applications.
World Monitor reads more than 500 curated feeds spanning geopolitics, finance, energy, climate, aviation, cyber, military, infrastructure, and news intelligence, while a freshness monitor tracks 35 source groups. It synthesizes news into briefs and renders events and infrastructure through either a globe.gl/Three.js globe or a deck.gl/MapLibre GL flat map. Its correlation layer combines military, economic, disaster, and escalation signals; the server-authoritative CII v8 calculates stress scores for 31 Tier-1 countries. The finance radar covers 29 stock exchanges, commodities, cryptocurrency, and a seven-signal market composite. Agents and scripts can enumerate and call tools at https://worldmonitor.app/mcp, use the REST base at https://api.worldmonitor.app, or invoke commands such as worldmonitor risk IR --api-key wm_xxx.
- A geopolitical analyst handling a breaking crisis can inspect news, military, disaster, and escalation signals together across maps and panels.
- A risk team can monitor CII v8 stress scores for 31 priority countries and review them alongside synthesized news briefs.
- A market researcher can follow 29 stock exchanges, commodities, cryptocurrency, and the seven-signal market composite from one interface.
- An energy or commodities organization can deploy a specialized
energyorcommodityvariant from the shared codebase. - A developer can feed global-monitoring data into scripts or agent workflows through MCP, REST, the CLI, or the Python, Ruby, and Go SDKs.
- An organization seeking greater control over AI processing can self-host the application and use Ollama locally.
What are this agent's strengths and limitations?
- Its scope is concrete and broad: more than 500 curated feeds, 56 map-layer types, 109 panel implementations, and six specialized variants share one codebase.
- It supports browser and native desktop use alongside MCP, REST, OpenAPI, CLI, and official Python, Ruby, and Go SDK access.
- Ollama provides a documented local-AI path, and the base application starts without environment variables or cloud AI credentials.
- Cross-stream correlation, server-authoritative CII v8 scoring, and a seven-signal market composite go beyond basic feed aggregation.
- Some data sources require separate credentials, and authenticated MCP
tools/calloperations require an API key or OAuth; a credential-free startup does not expose every feature. - The product depends on a large collection of network-accessed upstream sources, so upstream outages or stale data can reduce coverage and timeliness.
- Self-hosters must operate the Node.js/npm application and relevant caches, source integrations, and deployment configuration; the desktop architecture also uses Tauri 2, Rust, and a Node.js sidecar.
- The code is AGPL-3.0-only, so adopters must assess source-availability obligations for modified distribution and network services or obtain separate terms for proprietary use.
How do you install or deploy this agent?
Local development requires Node.js and npm. Run:
git clone https://github.com/koala73/worldmonitor.git
cd worldmonitor
npm install
npm run devThen open http://localhost:3000. The base application starts without environment variables; feature-specific sources may require credentials listed in .env.example. Variant development commands are npm run dev:tech, npm run dev:finance, npm run dev:commodity, npm run dev:happy, and npm run dev:energy. Vercel, Docker, and static deployment are documented as supported options, although complete deployment commands are not included in the supplied material.
How do you use this agent?
Browser users can open https://www.worldmonitor.app and work with its maps, layers, and intelligence panels. To inspect the public MCP tool catalog without a key, run npx worldmonitor tools. For authenticated CLI access, run npm install -g worldmonitor, obtain a World Monitor API key, and invoke worldmonitor risk IR --api-key wm_xxx; MCP tools/call similarly requires an X-WorldMonitor-Key header or OAuth. The MCP endpoint is https://worldmonitor.app/mcp, and the REST base is https://api.worldmonitor.app. The desktop installation provides all six variants inside one Tauri application rather than separate per-variant downloads.
FAQ
Can I run it without an API key?
npx worldmonitor tools can list MCP tools without a key. Some data sources need credentials, while MCP tools/call requires a World Monitor key or OAuth.