What is Global Threat Map?
Global Threat Map plots news events (conflicts, protests, disasters) on a Mapbox globe with colour-coded threat levels, a filterable event feed, keyword alerts, and layers for US and NATO bases. Clicking a country asks Valyu's Answer API for current and historical conflicts with citations; the dossier feature runs a Valyu DeepResearch task on any named actor and returns a report, CSV, PowerPoint and PDF.
It is a Next.js 16 app that needs a Mapbox token and a Valyu API key, with an optional OpenAI key for location extraction. Two modes exist: self-hosted, the default, with no sign-in, and a Valyu OAuth mode whose credentials come from Valyu on request.
Is Global Threat Map worth it?
Global Threat Map is the most popular of the Valyu showcase apps, with about 1,860 GitHub stars and 297 forks since January 2026, and it is best read as a showcase rather than a monitoring tool. Its events, country briefs and dossiers are search results and model summaries placed on a map; a pin says where a story was geocoded, not that something was verified there.
The security model is the first thing to understand. In the code, `isSelfHostedMode()` returns true unless `NEXT_PUBLIC_APP_MODE` is exactly `valyu`, so a fresh deploy with the variable missing or misspelt runs with no authentication, and every visitor's country lookup and dossier is billed to your key. Open issues filed against the repository report more: no rate limiting, a `valyu-proxy` route with no path allow-list, deep-research results readable by anyone with a task ID, and a token exposed on the Railway demo. We have not confirmed each, but none has a reply or fix in the issue list.
The catch: the project has gone quiet. The last commit was on 2 July 2026, there are no releases, 22 issues are open, and the SDK is pinned at valyu-js ^2.5.2, several minor versions behind the 2.11 line that added rate-limit retries and timeouts. The README promises ~50-page dossiers that take 5 to 10 minutes, while the code requests Valyu's fast mode (25 credits a task, about $0.16 at pay-as-you-go rates), so expect shorter reports than advertised. One open issue also argues that the fork count is inflated; treat stars and forks as interest, not use.
Our take: it is a good afternoon's read for anyone building a map-first research interface, and a poor thing to leave running publicly unless you put it behind your own login, a rate limiter and a Valyu spending cap first.
Where it earns its place
A newsroom developer prototyping a geopolitics explainer
Show editors what a clickable conflict map with cited briefs could look like
Run it locally with a Mapbox token and a Valyu key; a country click costs one Answer API call, a dossier one fast DeepResearch task. Rebuild the parts you keep, since the code is unmaintained.
A university OSINT course instructor
Give students a sandbox for comparing AI summaries against primary sources
Host one instance behind the campus SSO and a request cap, then have students check each event pin and dossier claim against the cited articles. The value is in the checking, not the map.
Before you commit
- Setup
- Clone, `npm install`, set `NEXT_PUBLIC_MAPBOX_TOKEN`, `VALYU_API_KEY` and `NEXT_PUBLIC_APP_MODE=self-hosted` in `.env.local`, then `npm run dev`. Under 30 minutes to a working map.
- Integrations
- valyu-js for search, answers and DeepResearch; Mapbox GL JS; optional OpenAI (gpt-4.1-nano by default) for location extraction. Newer API routes cover earthquakes, fire detections, military flights, nuclear facilities and Polymarket.
- Data and privacy
- Queries go to Valyu, and optionally OpenAI; the Mapbox token is public by design and baked into the client. In self-hosted mode there are no user accounts at all; in Valyu mode user info is kept in the browser's localStorage.
- Cost at scale
- Mapbox charges $5.00 per 1,000 map loads above 50,000 a month. Valyu costs scale with visitors in self-hosted mode because nothing limits them; a public instance needs a spending cap on the Valyu account.
- Limits
- No rate limiting in the code we read, 22 open issues, no releases. In Valyu mode, unauthenticated visitors get 2 free country lookups and no entity search.
What’s good
- Map, event feed, country briefs and dossiers in one Next.js app
- Dossiers export to CSV, PowerPoint and PDF
- Cited sources on country conflict summaries
- Docker and Railway deploy options
What’s not
- Fails open to no-auth mode unless APP_MODE is exactly valyu
- Open security issues (rate limiting, proxy, task access) unanswered
- No commits since July 2026; SDK pinned at ^2.5.2
- Licence stated only in the README; package.json says ISC and there is no LICENSE file
Best for
Developers studying how to build a map-based research front end on Valyu, run locally or behind their own access controls.
Global Threat Map alternatives
Global Threat Map: common questions
- Is Global Threat Map worth it?
- A striking demo of what a search API can put on a map, and a liability if you deploy it to the open internet as shipped. We rate it 3.3 out of 5.
- How much does Global Threat Map cost?
- Code free (README says MIT). Running it bills your Valyu credits for every lookup and dossier, and Mapbox after 50,000 map loads a month.
- What are the downsides of Global Threat Map?
- Fails open to no-auth mode unless APP_MODE is exactly valyu; open security issues (rate limiting, proxy, task access) unanswered; no commits since July 2026; SDK pinned at ^2.5.2; licence stated only in the README; package.json says ISC and there is no LICENSE file.
- Who is Global Threat Map best for?
- Developers studying how to build a map-based research front end on Valyu, run locally or behind their own access controls.
- How much does Global Threat Map cost for a team or in production?
- Mapbox charges $5.00 per 1,000 map loads above 50,000 a month. Valyu costs scale with visitors in self-hosted mode because nothing limits them; a public instance needs a spending cap on the Valyu account.
- Is Global Threat Map safe for company data?
- Queries go to Valyu, and optionally OpenAI; the Mapbox token is public by design and baked into the client. In self-hosted mode there are no user accounts at all; in Valyu mode user info is kept in the browser's localStorage.
- What are the best Global Threat Map alternatives?
- The closest alternatives we have reviewed are God's Eye View and Global Hack Map.
Answers checked Nov 3, 2026.