Is koala73/worldmonitor safe?

const out = execSync(
      `git diff --unified=0 origin/main...HEAD -- "${filePath}"`,

const out = execSync(
    `find ${TARGET_DIRS.join(' ')} -type f \\( -name '*.ts' -o -name '*.tsx' -o -name '*.mjs' -o -name '*.js' \\) -not -path '*/node_modules/*' -not -path '*/_generated/*'`,

const out = execSync(`grep -rnE "${PAT}" --include="*.ts" --include="*.js" src api convex server 2>/dev/null || true`, { encoding: 'utf8', maxBuffer: 1 << 26 });

const blockNeedle = 'eval("var res = [';

const arrayOpen = start + 'eval("var res = '.length; // points at `[`

"postinstall": "npm run inventory:facts",

"name": "query_docs_filesystem_world_monitor",

"name": "get_economic_data",

"name": "get_cross_border_arrivals",

"name": "get_imd_cyclone_marine",

"name": "get_hotspot_escalation",

const FREE_MAP_PANEL_ACCESS_KEY = 'worl…[redacted, 37 chars]';

import { spawnSync } from 'node:child_process';

const result = spawnSync('npm', ['audit', '--omit=dev', '--json'], { cwd, encoding: 'utf8' });

return spawnSync('git', args, { encoding: 'utf8' });

import { spawnSync } from 'node:child_process';

import { spawnSync } from 'node:child_process';

import { execFileSync } from 'node:child_process';

import { spawn } from 'node:child_process';

const child = spawn(process.execPath, [...nodeArgs, scriptPath], {

import { spawnSync } from 'node:child_process';

const result = spawnSync('gh', args, {

import { execFileSync } from 'node:child_process';

raw = exec('curl', args, {

const { spawn } = require('node:child_process');

import { spawnSync } from 'node:child_process';

import { spawnSync } from 'node:child_process';

const { execFile } = require('child_process');

const { execFileSync } = require('child_process');

import { execSync } from 'node:child_process';

return execSync('git rev-parse HEAD', { cwd: REPO_ROOT, stdio: ['ignore', 'pipe', 'ignore'] })

import { spawnSync } from 'node:child_process';

const result = spawnSync(

const result = spawnSync('npm', args, {

import { execFileSync } from 'node:child_process';

import { execFileSync } from 'node:child_process';

import { execSync } from 'node:child_process';

return requestId.includes('::') ? requestId.split('::', 1)[0] : null;

const host = process.env.HOST ?? '0.0.0.0';

server.listen(PORT, '0.0.0.0', () => {

['0.0.0.0', 8],       // "this" network

const src = fs.readFileSync(filePath, 'utf8');

const src = fs.readFileSync(filePath, 'utf8');

const src = fs.readFileSync(CATALOG_PATH, 'utf8');

raw = await fs.readFile(filePath, 'utf8');

const raw = await fs.readFile(path.resolve(REPO_ROOT, FIXTURE_PATH), 'utf8');

const raw = await fs.readFile(path.resolve(REPO_ROOT, BASELINE_PATH), 'utf8');

const existing = JSON.parse(fs.readFileSync(existingPath, 'utf8'));

const geojson = JSON.parse(fs.readFileSync(geojsonPath, 'utf8'));

return JSON.parse(await fs.readFile(filePath, 'utf8'));

const { rows: golden } = JSON.parse(fs.readFileSync(file, 'utf8'));

const golden = args.golden ? JSON.parse(fs.readFileSync(args.golden, 'utf8')) : null;

const snapshot = JSON.parse(await fs.readFile(path.join(REPO_ROOT, relativePath), 'utf8'));

await fs.readFile(path.join(REPO_ROOT, 'shared', 'crawlable-crises.json'), 'utf8'),

await fs.readFile(path.join(rootDir, 'docs', 'snapshots', filename), 'utf8'),

const sourceText = await fs.readFile(RESILIENCE_SCORER_PATH, 'utf8');

resilienceCacheKeysPromise ||= fs.readFile(

const raw = await fs.readFile(path.join(REPO_ROOT, 'shared', 'country-names.json'), 'utf8');

const snapshot = JSON.parse(await fs.readFile(LEGACY_COUNTRY_SNAPSHOT_PATH, 'utf8'));

const fileContent = await fs.readFile(targetFile, 'utf-8');

const geojson = JSON.parse(fs.readFileSync(path.join(root, 'public', 'data', 'countries.geojson'), 'utf8'));

const geojson = JSON.parse(fs.readFileSync(path.join(root, 'public', 'data', 'countries.geojson'), 'utf8'));

// Implementation: reads via fs.readFileSync (rather than ES JSON

// fs.readFileSync (so seeders can run under plain `node`); this .ts

fs.writeFileSync(tmpPath, payload, 'utf8');

await fs.writeFile(path.resolve(REPO_ROOT, OUT_PATH), md, 'utf8');

fs.writeFileSync(existingPath, JSON.stringify(sorted, null, 2) + '\n');

await fs.writeFile(outPath, `${JSON.stringify(artifact, null, 2)}\n`, 'utf8');

fs.writeFileSync(args.golden, `${JSON.stringify(golden, null, 1)}\n`);

if (args.out) fs.writeFileSync(args.out, JSON.stringify(report, null, 2));

await fs.writeFile(outPath, `${JSON.stringify(snapshot, null, 2)}\n`, 'utf8');

await fs.writeFile(outPath, `${JSON.stringify(snapshot, null, 2)}\n`, 'utf8');

await fs.writeFile(temporaryTarget, updatedContent, 'utf-8');

fs.writeFileSync(out, JSON.stringify(sorted, null, 2) + '\n');

fs.writeFileSync(path.join(root, 'scripts', 'shared', 'country-bboxes.json'), JSON.stringify(sorted, null, 2) + '\n');

fs.writeFileSync(jsOut, jsLines.join('\n'));

fs.writeFileSync(dtsOut, dtsLines.join('\n'));

fs.writeFileSync(out3to2, JSON.stringify(sorted3to2, null, 2) + '\n');

fs.writeFileSync(out2to3, JSON.stringify(sorted2to3, null, 2) + '\n');

fs.writeFileSync(jsOut2to3, js2to3.join('\n'));

fs.writeFileSync(dtsOut2to3, dts2to3.join('\n'));

await fs.writeFile(outPath, JSON.stringify(aggregate, null, 2), 'utf8');

fs.writeFileSync(overflowPath, '', { flag: 'wx', mode: 0o600 });

with open(path) as f:

data = json.loads(source.read_text(encoding="utf-8"))

actual = target.read_text(encoding="utf-8") if target.exists() else ""

target.write_text(expected, encoding="utf-8", newline="\n")

response = await client.fetch(

res = await fetch(RELEASES_URL, {

const response = await fetch(url, {

const resp = await fetch(`${creds.url}/get/${encodeURIComponent(key)}`, {

return await fetch(url, { ...options, signal: controller.signal });

"api.axios.com",

"www.axios.com",

const res = await fetch(_envelopeUrl, {

* envelope format, stack parsing, and fire-and-forget fetch (with

const resp = await fetch(`${creds.url}/pipeline`, {

const resp = await fetch(`${url}/get/${encodeURIComponent(raw ? key : applyRedisKeyPrefix(key))}`, {

const resp = await fetch(`${url}/get/${encodeURIComponent(raw ? key : applyRedisKeyPrefix(key))}`, {

const resp = await fetch(`${creds.url}/pipeline`, {

const response = await fetch(AXIOM_INGEST_URL, {

resp = await fetch(`${config.siteUrl}${path}`, {

const res = await fetch(`${convexSiteUrl}/relay/followed-countries`, {

const resp = await fetch(`${creds.url}/pipeline`, {

const resp = await fetch(

fetch: (...args) => globalThis.fetch(...args),

const resp = await createCheckoutDeps.fetch(`${CONVEX_SITE_URL}/relay/create-checkout`, {

const resp = await fetch(`${CONVEX_SITE_URL}/relay/customer-portal`, {

const res = await fetch(`${UPSTASH_URL}/getdel/${encodeURIComponent(key)}`, {

await fetch(`${UPSTASH_URL}/lpush/wm:events:queue/${encodeURIComponent(msg)}`, {

const tokenRes = await fetch('https://discord.com/api/oauth2/token', {

const convexRes = await fetch(`${CONVEX_SITE_URL}/relay/notification-channels`, {

import urllib.request

req = urllib.request.Request(
        request["url"],
        data=request.get("body"),
        headers=request.get("headers") or {},
        method=request.get("method", "GET"),
    )

with urllib.request.urlopen(req, timeout=timeout) as res:

url += "?" + urllib.parse.urlencode({k: _stringify(v) for k, v in query.items()})

*   - U5 `api/oauth/authorize-pro.ts` — verifies the grant on the api

*   `api/oauth/token.js` after U5's `/oauth/authorize-pro` flow): a JSON

grant_type: 'authorization_code',

const oauthUrl = new URL('https://discord.com/oauth2/authorize');

// The decision is shared with mcp-grant-mint.ts and oauth/authorize-pro.ts

* `api.worldmonitor.app/oauth/authorize-pro` (U5).

*      JSON `{nonce}` (nonce minted by `api/oauth/authorize.js` and

const AUTHORIZE_PRO_URL = 'https://api.worldmonitor.app/oauth/authorize-pro';

// written by api/oauth/authorize.js and api/oauth/register.js with NO

// Shared with mcp-grant-context.ts and oauth/authorize-pro.ts

//     claim's exp, so `/oauth/authorize-pro` strictly compares them

// the EXISTING claim's exp so `/oauth/authorize-pro`'s strict tuple

* interactive `/oauth/authorize` consent ties the issued token to whoever signs

authorization_endpoint: `${origin}/oauth/authorize`,

// RFC 9207: /oauth/authorize and /oauth/authorize-pro append `iss` to the

claim_uri: `${origin}/oauth/authorize`,

claim_uri: `${origin}/oauth/authorize`,

// ChatGPT: the stable callback requires RFC 9207 `iss` (api/oauth/authorize.js)

// (api/oauth/authorize.js, api/internal/mcp-grant-context.ts). A custom-scheme

* GET /oauth/authorize-pro

*      `api/oauth/authorize.js`. One-shot — replay fails on the second hit.

/** OAuth authorization-code TTL — matches `api/oauth/authorize.js:10`. */

* `api/oauth/authorize.js::htmlError` (line 89). Kept identical so the

*     English copy (matching `api/oauth/authorize.js::htmlError`), so it is not

// Redis helpers — match the on-the-wire format used by api/oauth/authorize.js

"mcpServers": {

{

"tools": true,

"tools": true,

{

{

registration = provider.registerTool(tool, { signal: controller.signal });