Primary question: Can your team comply with AGPL-3.0 source-disclosure obligations while running a real-time OSINT dashboard that depends on third-party RSS and news feeds?
RepoDaily adoption score
RepoDaily rates this as 90/100 (strong) for adoption: evidence, installation path, production risk, differentiation, license clarity, and AI/agent fit are scored from the article sources and adoption notes.
5 source(s) across 3 source category/categories, plus a RepoDaily-specific evidence module when available.
7 workflow step(s), 6 next-action step(s), and 5 command/install signal(s) were detected.
Trending momentum is +1,167 stars, with maintenance/release/issue signals counted when present.
Risk is marked medium, with 5 security note(s) and 4 explicit skip condition(s).
3 opportunity lens item(s), 4 alternative(s), and 3 type-specific section(s) support differentiation.
License source or license wording is present.
4 AI/agent-related signal(s) were detected in the article text and metadata.
Project overview
WorldMonitor is a real-time global intelligence dashboard written entirely in Vanilla TypeScript — no React, no Vue, no UI framework at all. It aggregates OSINT data streams, applies AI-powered signal analysis, and renders everything on an interactive map powered by MapLibre GL and deck.gl. During this trending period it earned 1,167 stars and ranked ninth, a signal that developers are actively looking for open-source alternatives to commercial intelligence platforms like Palantir and Recorded Future.
The project's defining architectural choice is its variant system. A single codebase produces six distinct dashboards, each targeting a different intelligence domain. The `full` variant covers geopolitics, military conflicts, and infrastructure. `tech` focuses on startups, AI/ML, cloud, and cybersecurity. `finance` tracks markets, central banks, and commodities. `commodity` and `energy` narrow in on mining, energy markets, and energy security chokepoints. `happy` surfaces positive news and constructive signals. Variant configs live in `src/config/variants/` and are selected at build time via Vite environment variables.
Under the hood, World Monitor uses a custom Protobuf-first RPC framework called Sebuf. Service and message definitions in `proto/` span 36 domains, and Sebuf auto-generates typed client and server stubs into `src/generated/`. This gives the project compile-time API contracts across 35 server handler domains without pulling in a heavyweight framework like gRPC-Web or tRPC. The server handlers live in `server/`, edge functions in `api/`, and the result is a single TypeScript pipeline from protobuf definition to deployed API gateway on Vercel Edge Functions.
Distribution is broad: the npm package `worldmonitor`, a PyPI SDK `worldmonitor-sdk`, a RubyGem `worldmonitor`, a Go SDK at `github.com/koala73/worldmonitor/sdk/go`, and an MCP server published via Smithery. Desktop builds use Tauri v2 for Windows, macOS, and Linux, wrapping the Vite frontend with a Node.js sidecar (`local-api-server.mjs`). The license is AGPL-3.0, which permits self-hosting but requires source-code disclosure for any modified version exposed over a network.
Why it is trending now
- 1,167 stars this period at trending rank 9, indicating rapid developer interest in self-hostable OSINT tooling
- Six production variants from one codebase — geopolitical, tech, finance, commodity, energy, and positive-news — each with distinct map layers, panels, and RSS feeds
- AGPL-3.0 license makes the full source available for self-hosting, unlike closed commercial intelligence platforms
- Custom Protobuf-first RPC framework (Sebuf) spans 36 domains, providing typed API contracts without gRPC-Web or tRPC
- Multi-language SDK distribution: npm, PyPI, RubyGems, Go, plus an MCP server on Smithery for AI agent integration
- Desktop builds via Tauri v2 targeting Windows, macOS, and Linux alongside six hosted web variants at *.worldmonitor.app
Problem it solves
- OSINT data is scattered across RSS feeds, news APIs, social media streams, and manual monitoring tools with no unified visualization layer
- Commercial intelligence platforms (Palantir, Recorded Future, Maltego) are closed-source, expensive, and not self-hostable
- Analysts need map-centric, real-time overlays for geographic events — conflicts, infrastructure disruptions, shipping chokepoints — that combine multiple data sources
- Self-hosting a full situational-awareness stack typically requires assembling separate ingestion, mapping, alerting, and analysis tools
How it works
- Clone the repository and run `npm ci` — the postinstall script also installs blog-site dependencies
- Select a variant using `npm run dev` (full), `npm run dev:tech`, `dev:finance`, `dev:commodity`, `dev:happy`, or `dev:energy` — each sets `VITE_VARIANT` and loads corresponding configs from `src/config/variants/`
- Sebuf generates typed client and server stubs from Protobuf definitions in `proto/` covering 36 domains — outputs land in `src/generated/` and must not be edited by hand
- MapLibre GL renders the base map (tiles, globe mode, camera control); deck.gl overlays WebGL layers including scatterplot, geojson, arcs, and heatmaps
- d3 powers charts and sparklines; Web Workers in `src/workers/` handle background signal analysis without blocking the UI
- Vercel Edge Functions in `api/` serve the API gateway; for desktop, Tauri v2 wraps the frontend with `src-tauri/sidecar/local-api-server.mjs`
- For Docker self-hosting, a three-stage build compiles TS handlers via `docker/build-handlers.mjs`, builds the Vite frontend, and serves nginx + node under supervisord on port 8080
Product demo and interface preview
Architecture: Vanilla TypeScript, Sebuf RPC, and 163 Components
World Monitor deliberately avoids UI frameworks. The entire frontend — 163 top-level TypeScript component files in `src/components/` — is Vanilla TypeScript built with Vite. This removes framework abstraction overhead and keeps the rendering stack close to the DOM, but it also means contributors must understand the component patterns the project has established rather than relying on React or Vue conventions.
The Sebuf RPC framework is the project's most distinctive infrastructure choice. Service and message definitions live in `proto/` using Protobuf and Buf. Sebuf compiles these into typed client wrappers in `src/services/` and server handler stubs for 35 handler domains in `server/`. The `src/generated/` directory holds all auto-generated code and is explicitly marked as do-not-edit. The `scripts/enforce-sebuf-api-contract.mjs` lint script verifies that API routes conform to the proto definitions, catching drift at CI time.
The map stack pairs MapLibre GL for base rendering (tiles, globe mode, camera) with deck.gl for WebGL overlay layers (scatterplot, geojson, arcs, heatmaps). d3 handles supplementary charts and sparklines. The combination supports dense geographic visualization without a commercial mapping license. Static datasets for geographic features, military installations, pipelines, and ports live in `src/config/` and `data/` as JSON files.
Commands, Lint Scripts, and Security Checks
- Dev: `npm run dev` (full), `npm run dev:tech`, `dev:finance`, `dev:commodity`, `dev:happy`, `dev:energy` — each uses `cross-env` to set `VITE_VARIANT`
- Lint: `npm run lint` runs Biome across `src`, `server`, `api`, `tests`, `e2e`, `scripts`, and `middleware.ts`, plus `lint:safe-html` for HTML sanitization enforcement
- API contract: `npm run lint:api-contract` executes `scripts/enforce-sebuf-api-contract.mjs` to verify route/proto alignment
- Rate limiting: `npm run lint:rate-limit-policies` enforces rate-limit configurations via a dedicated tsx script
- Security: `npm run security:local-env-dumps` and `npm run security:vite-env-secrets` scan for leaked secrets in local environments and Vite env files
- Unicode safety: `npm run lint:unicode` runs `scripts/check-unicode-safety.mjs` to prevent problematic Unicode characters
- Build: `npm run build` executes `security:vite-env-secrets --strict`, then builds the Vite frontend and crawlable corpus
Docker Self-Hosting: Three Stages, Port 8080, Non-Root
The Dockerfile defines a three-stage multi-stage build. Stage 1 (builder) uses `node:24-alpine`, runs `npm ci --ignore-scripts`, compiles TypeScript API handlers into self-contained ESM bundles via `docker/build-handlers.mjs`, then builds the crawlable static corpus and Vite frontend into `dist/`. Stage 2 (runtime-deps) installs only the minimal runtime packages listed in `docker/runtime-package.json` — deliberately smaller than the full production dependency graph. Stage 3 (final) combines nginx for static files with a Node.js sidecar for API routes, managed by supervisord.
The final image runs as non-root `appuser` in the `appgroup` group. The healthcheck probes `/api/sidecar-health` — an auth-exempt liveness route in `local-api-server.mjs` — through nginx's `/api/` proxy on `127.0.0.1:8080`. The Dockerfile explicitly notes using `127.0.0.1` instead of `localhost` because `localhost` resolves to `::1` first, where nginx does not listen. The sidecar needs runtime dependencies like `@upstash/ratelimit` that are not bundled by `build-handlers.mjs`, and the Dockerfile documents this explicitly to explain why `node_modules` is copied into the final stage.
Who should pay attention?
Good fit if
- OSINT analysts and geopolitical researchers who want a self-hosted, map-centric dashboard instead of a commercial SaaS
- Newsrooms and think tanks tracking real-time global events across military, energy, finance, and tech domains
- Developers evaluating a Vanilla TypeScript + Protobuf architecture for large-scale mapping dashboards
- Teams needing a desktop-capable intelligence tool packaged via Tauri v2 for offline or air-gapped environments
Skip for now if
- Organizations that cannot comply with AGPL-3.0 source-disclosure requirements for network-accessible modified versions
- Teams whose data reliability depends on guaranteed SLAs — World Monitor aggregates external RSS and news feeds whose availability is outside the project's control
- Projects requiring mature multi-maintainer governance — the LICENSE names Elie Habib as the sole copyright holder
- Users who need a turnkey SaaS without any local setup, configuration, or Docker deployment
Risks and cautions
AGPL-3.0 constrains commercial network deployments, the codebase is large (163 components, 35 handler domains, 25 locale files) under a single primary maintainer, and data reliability depends on third-party RSS and news sources.
- AGPL-3.0 Section 13 requires source-code disclosure for any modified version accessible over a network, which limits closed-source commercial use
- The codebase has 163 top-level component files and 35 server handler domains — onboarding new contributors requires understanding Sebuf, the variant system, and the custom lint pipeline
- External data sources (RSS feeds, news APIs) are not under the project's control; feed outages or API changes can degrade dashboard accuracy without warning
- The LICENSE names a single copyright holder (Elie Habib), meaning bus-factor risk exists for long-term maintenance commitments
- Dockerfile runs the final image as non-root `appuser` with explicitly chowned writable directories
- Two dedicated security scripts: `security:local-env-dumps` and `security:vite-env-secrets` (the latter runs with `--strict` during build)
- Custom lint scripts enforce API contract compliance, rate-limit policies, safe HTML rendering, and Unicode safety
- Runtime dependency set in Docker is deliberately minimal (`docker/runtime-package.json`) to reduce attack surface
- Playwright covers end-to-end and visual regression tests in the `e2e/` directory
Alternatives to compare
| Approach | When to use | Trade-off |
|---|---|---|
OpenCTI | You need structured cyber-threat-intelligence management with STIX/indicator-of-compromise workflows rather than a geopolitical map dashboard | Free / open-source (BSD-3-Clause) |
MISP | Your priority is sharing threat indicators across organizations and communities, not real-time situational map visualization | Free / open-source (AGPL-3.0) |
Recorded Future | You need a commercial, fully managed intelligence platform with dedicated analyst support and proprietary data collections | Commercial subscription |
Palantir Foundry / Gotham | Your organization requires enterprise-grade data integration, ontology modeling, and government-compliant deployment at scale | Commercial enterprise license |
What this trend reveals
Custom Variant Creation for Niche Domains
The variant system in `src/config/variants/` uses Vite environment variables to switch panels, map layers, and RSS feeds. A new variant — for example, climate-monitoring or public-health surveillance — can be created by adding a config directory and an npm script mirroring the existing `dev:*` pattern.
Clone the repo, copy an existing variant config from `src/config/variants/`, add a `dev:climate` script in package.json, and run it locally to verify panel and feed switching.
MCP Server Integration for AI-Powered Intelligence Briefings
World Monitor publishes an MCP server (`wm-mcp`) via Smithery. This allows AI agents to query the dashboard's data programmatically — requesting real-time geopolitical summaries, infrastructure status, or market signals through a standardized tool interface.
Install the MCP server from `smithery.ai/servers/worldmonitor/wm-mcp`, connect it to an MCP-compatible AI client, and issue a natural-language query about current geopolitical events.
Self-Hosted Intelligence Dashboard for Newsrooms
Newsrooms that currently rely on manual monitoring across multiple tabs and feeds could deploy the Docker image on port 8080, configure domain-specific RSS sources, and provide reporters with a unified map-centric view of breaking events.
Deploy via the three-stage Dockerfile, configure RSS feeds in `src/config/`, and verify that the `/api/sidecar-health` healthcheck passes through the nginx proxy.
RepoDaily verdict
World Monitor is the most architecturally ambitious open-source OSINT dashboard available right now. Its Vanilla TypeScript + Sebuf + MapLibre stack is unconventional but internally consistent, and the six-variant system from one codebase is a genuinely clever design. The AGPL-3.0 license, single-maintainer governance, and reliance on external feeds are the real adoption barriers — but for teams that can navigate those constraints, this is a serious self-hostable alternative to commercial intelligence platforms.