Six site variants turn one codebase into several monitoring desks
World Monitor combines a global map with news, markets, disasters, military activity, aviation, infrastructure, and generated briefs. The same codebase produces six public variants for world, tech, finance, commodities, positive news, and energy. Its Country Instability Index covers 31 Tier-1 countries. You can also reach the data through a REST API, an MCP server, a CLI, and official Python, Ruby, and Go clients. That is much broader than a map with RSS markers.
The useful trick is juxtaposition. A market move, a shipping disruption, and a cluster of reports can appear in the same workspace, so an analyst knows where to look next. World Monitor does not turn those signals into settled facts. The open source-disagreement evaluation still asks how conflicting claims should be preserved, scored, and shown. Until that work reaches the product, a clean panel can hide disagreement that lives upstream.
Full self-hosting starts four containers and four required secrets
The README's development path is short: clone, install, run the dev command, and open port 3000. The self-hosting guide is the honest production picture. It requires Docker or Podman, Node.js 22+, and four generated secrets before compose will start. The stack runs four containers: the web and API service, Redis, a Redis REST proxy, and an AIS relay. Seed scripts run separately on the host.
Public sources provide a useful base, while richer feeds need credentials for services such as ACLED, NASA FIRMS, market providers, or an AI endpoint. Open issue 8537 says three compose services still use local build sections without equivalent published images. The published frontend image points at the hosted API instead. In practice, the 2,149 MB dependency install is only one part of the footprint. Operators also own image builds, secrets, schedules, and Redis persistence.
What happened when we ran it
Our run at commit 0f959d5 installed 1,900 npm packages in 160 seconds and occupied 2,149 MB on disk. The production build completed in 178 seconds. Our test method used a fresh unprivileged Debian container with 3 CPUs, 8 GB of RAM, Node.js 22, and no secrets. These results establish that installation and compilation worked in that environment. They do not measure browser speed, feed freshness, map accuracy, or AI output quality.
The repository contained 7,564 files and about 1,350,935 lines of source in a 141.5 MB checkout. It had 50 CI workflow files, a Dockerfile, a compose file, and a tests directory. Even so, the measured commit exposed no test script or target, so our harness skipped tests. Npm audit reported 21 known vulnerabilities: 1 high and 20 moderate. A successful build does not clear those findings or replace an executable local test gate.
A provider failure left one geopolitical panel empty
Open issue 8676 records a useful warning about data ownership. The Geopolitical Tensions section of the Pentagon Pizza Index panel had been empty since September 25, 2026 because a private PizzINT endpoint returned HTTP 500. World Monitor already ingested a GDELT event export, but that panel still depended on the failing provider. The proposed fix was to calculate six country-pair tension series from data the project already held.
That failure is easier to trust than a silently normal score because it exposes the missing feed. It also shows why self-hosting is an ongoing data job. Each source has its own coverage, freshness rules, quota, and error behavior. Redis can preserve a last good value, but a cached response needs a visible timestamp and health state. For decisions involving conflict or public safety, open the cited source and confirm that absence means no event, rather than no data.
Fifty workflow files still left our commit without a test command
World Monitor plainly invests in automation: our scan found 50 CI workflow files and a tests directory. The gap is discoverability and reproducibility at the commit we measured. With no test script or target, a contributor could run the 178-second build but could not invoke a documented default suite through the harness. Teams adopting a fork should identify the relevant workflow commands, pin them in their own release gate, and confirm that source-health behavior is covered.
Activity itself is unusually strong. GitHub showed 87,651 stars and 347 open issues and pull requests on October 1, 2026. A separate search split that queue into 256 issues and 91 pull requests. The default branch was pushed that day, while v2.10.0 had shipped on September 8. Those dates describe an active project with a large review surface. They do not erase the 21 audit findings or make every open data-quality item urgent.
AGPL-3.0 and source verification define the buyer fit
World Monitor uses AGPL-3.0-only for its source and offers separate commercial terms for teams that need private-source use or branding permission. Network operators should review those obligations before adding proprietary connectors. Programmatic access also changes by mode: the hosted MCP server accepts an API key or OAuth for tool calls, while a self-hosted MCP route uses operator-configured keys. The public browser can start simply, but a private integration has an access-control design to own.
Our 1,900-package run supports a narrow recommendation. World Monitor is a good evaluation candidate for an analyst or engineering team that values breadth, can operate the four-container stack, and checks original sources before acting. It is a poor fit for a small server, a closed-source fork without separate terms, or a workflow that treats an AI brief as evidence. The adoption gate should be concrete: map every required panel to its provider, freshness signal, and failure display before trusting the dashboard on a bad day.