World Monitor: A Live Global Intelligence Dashboard (GitHub, Scanned)

World Monitor gathers public signals about the state of the world into one screen. Curated news feeds from global and regional outlets are summarised into AI briefs, and a 3D globe (globe.gl) or a WebGL flat map (deck.gl) carries layers for conflict, military flights, shipping chokepoints, cyber threats, climate events, energy and infrastructure. Panels track stock exchanges, commodities, crypto and prediction markets, and a Country Instability Index scores 31 countries with approximate 24-hour movement. The same codebase builds tech, finance, commodity, energy and good-news variants, a Tauri desktop app, a terminal dashboard (npx worldmonitor), SDKs and an MCP server for AI agents.

It comes from Elie Habib and grew unusually fast: created in January 2026, it has about 89,700 stars, 171 contributors, more than 9,000 commits and 50 releases, the latest (v2.11.6) on 25 October 2026, with commits landing daily. The hosted site at worldmonitor.app is free to browse, and a Pro plan sells API keys for the REST API, CLI and MCP tools.

The code is AGPL-3.0. You can self-host, fork and use it commercially, but if you run a modified copy as a service you have to publish your changes; the README offers a separate commercial licence for teams that cannot. The app starts with no environment variables, and AI summaries can run on a local Ollama model, so API keys are only needed for the feeds that require them.

• Repository: github.com/koala73/worldmonitor
• Licence: AGPL-3.0 (GNU Affero General Public License v3.0)
• Language: TypeScript. Stars: 89.7K. Forks: 13.8K. Last push: Oct 28, 2026.
• Scan: safe, Oct 28, 2026, commit 91c50b1

Who it is for

Analysts, journalists and researchers who follow geopolitics or markets and want one situational view, OSINT hobbyists, and developers who want a large, well-tested open-source dashboard or an agent-ready source of world data.

Getting started

1. Try the terminal dashboard without installing anything (no key needed)

npx worldmonitor

2. Or clone the web app (Node.js and npm)

git clone https://github.com/koala73/worldmonitor.git && cd worldmonitor

3. Install the dependencies

npm install

4. Start it, then open http://localhost:3000

npm run dev

Nothing is required to start; some feeds need their own credentials, listed in .env.example. A self-hosted copy still loads its analytics script from abacus.worldmonitor.app, although the tracker only records visits on the official worldmonitor.app hostnames.

Safety scan

We cloned koala73/worldmonitor at commit 91c50b1 on Oct 28, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.

• A large codebase: 8,945 files and about 2.4 million lines, mostly JavaScript and TypeScript. The one secret hit is a fake ghp_ token in tests/railway-reconcile-manifest.test.mjs, written to prove that token-like names are rejected. The 37 bare-IP URLs are all tests using documentation and reserved ranges (TEST-NET, 93.184.216.34) to prove the webhook and proxy guards refuse them.
• The four api.telegram.org hits are the alert feature sending to the bot token you configure, and the curl | sh hit is a hint message in the build prerequisite check suggesting rustup. The root postinstall hook runs a local script that writes an inventory facts file, with no network access; src-tauri/build.rs is the standard one-line Tauri build script.
• 3,657 locked packages across 12 lockfiles, with 24 known advisories: none critical, and the only two high ones (mysql2 and deepmerge-ts) are in docker/umami/runtime, the project's own analytics server, not the dashboard. The main package-lock has five moderate or low; most of the Rust desktop findings are notices that old crates are unmaintained.
• Telemetry, read from the source: Sentry error reporting is off unless you set VITE_SENTRY_DSN (empty in .env.example), Umami is limited to the worldmonitor.app hostnames, and Vercel Web Analytics only reports on a Vercel deployment. The network hosts are the news, market and data sources the panels read.
• 53 workflows. contributor-trust.yml uses pull_request_target, but the scanner's checkout match is a warning comment: the job never checks out PR code, it only looks up the author's name and adds a label. All 19 third-party actions are pinned to commits. Security policy, Dependabot, CodeQL, licence, contributing guide and code of conduct all present.

What the scanner counted

The raw findings

Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.

By the numbers

Lines by language: JavaScript 913.9K, TypeScript 636.8K, JSON 520.3K, Markdown 159.4K, YAML 83.7K, CSS 40.4K.

Questions

Is World Monitor free?

Yes. The website and its variants are free to browse, the desktop app and terminal dashboard are free downloads, and the source is AGPL-3.0, so self-hosting costs nothing beyond your own server. A paid Pro plan sells API keys for the REST API, CLI and MCP server, and a commercial licence exists for teams that cannot meet the AGPL's terms.

Where does World Monitor's data come from?

From public and attributed upstream sources: news outlets and Google News, official statistics such as the World Bank, IMF and St. Louis Fed, market data, prediction markets, ADS-B flight data from Wingbits, and conflict, cyber and climate feeds. The project publishes a data sources catalogue with each provider's licence posture. AI summaries are machine-written, so check the linked articles before relying on them.

Is it legal to use World Monitor for research?

Yes. It shows aggregated public information about countries, markets and infrastructure, not individuals, so it suits journalism, risk analysis and teaching. Each upstream source keeps its own terms, which matter if you republish its data, and if you run a modified copy as a public service the AGPL requires you to publish your source code.

This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.