worldmonitor npm CLI: the MCP server is the live, documented agent surface (tools/list is public; get_sources is the sole credential-free, daily-quota-free data tool; every other data-bearing tools/call needs a subscription API key), and a small REST escape hatch rounds each SDK out for host-relative and self-hosted use.
Find and verify the official packages
Use the exact package names in the table. npm, PyPI, RubyGems, and crates.io link toworldmonitor.app in their project metadata; compare those links with the source repositories listed here. The Python package is worldmonitor-sdk. The PyPI package named worldmonitor is an unrelated project.
The Go SDK is the module github.com/koala73/worldmonitor/sdk/go, with package name worldmonitor. Go modules have no registry homepage field. Verify its module path against the official repository linked above and its product links on pkg.go.dev.
- Search pkg.go.dev for worldmonitor.
- Read the Go module proxy’s latest release metadata.
- Install with
go get github.com/koala73/worldmonitor/sdk/gofrom your Go project.
sdk/go/vX.Y.Z) and the module proxy. A successful proxy lookup confirms release availability; pkg.go.dev search confirms search visibility. See how pkg.go.dev adds packages.
Rust
Theworldmonitor crate is published on crates.io. Install it with cargo add worldmonitor. Read the Rust API documentation for version 0.1.0.
The blocking client supports public MCP listings, any MCP tool through call_tool, a country_risk helper, and host-relative REST requests. It uses reqwest with Rustls and serde_json. The Python, Ruby, Go, and JavaScript clients have no runtime dependencies.
Shared design
The clients share the MCP protocol and use language-native APIs:- Any MCP tool —
call_tool/CallToolwith named arguments; the result is the unwrapped JSON-RPCresult. - Curated helpers vary by SDK. Rust includes
country_risk; usecall_toolfor other tools and optional arguments. - Public listings —
list_tools,list_prompts,list_resourcesneed no key. - REST escape hatch —
get("/api/…")andhealth()againstapi.worldmonitor.app. - Configuration via constructor arguments or the
WORLDMONITOR_API_KEY(aliasWM_API_KEY),WORLDMONITOR_BASE_URL, andWORLDMONITOR_MCP_URLenvironment variables. - Errors split into an MCP error (JSON-RPC
errorobject, auth failures carry a key hint) and an API error (non-2xx transport). - A descriptive User-Agent (
worldmonitor-<lang>/<version>) — the API edge challenges generic library agents, so keep it if you fork.
jmespath argument for server-side projection — typically an 80–95% response-size cut.
Python
Ruby
Go
JavaScript
The npm package doubles as the command-line client and a library:Get a key
get_sources is the sole tools/call data tool that needs no credentials and consumes no daily quota; anonymous calls use a separate fail-closed ceiling of 10/minute/IP. Every other data tool needs a subscription API key — issue one at worldmonitor.app/pro. See Authentication for how keys, OAuth, and browser sessions differ, and Rate Limits for per-plan allowances.
Releasing (maintainers)
Each SDK versions independently. npm, Python, and Ruby use OIDC trusted publishing; Go uses repository tags and the public module proxy. No long-lived registry tokens are needed (see the CLI release runbook for the npm flow):- Python: bump
versioninsdk/python/pyproject.tomland__version__insdk/python/src/worldmonitor_sdk/__init__.py, then tagpy-vX.Y.Z(workflowpublish-python.yml). - Ruby: bump
WorldMonitor::VERSIONinsdk/ruby/lib/worldmonitor/version.rb, then taggem-vX.Y.Z(workflowpublish-ruby.yml). - Go: bump
Versioninsdk/go/worldmonitor.go, then tagsdk/go/vX.Y.Z(workflowpublish-go.ymlvalidates and warms the module proxy). - Rust: follow the Rust release runbook. Later releases use OIDC after the crates.io trusted publisher is configured. Run
publish-rust.ymlfrommainwith a verifiedrust-vX.Y.Ztag anddry_run=true, then publish withdry_run=falseafter owner approval.
tests/sdk-packages.test.mjs checks package identity, version declarations, registry metadata, and release workflow wiring.