Skip to main content
These endpoints pass caller requests through to an upstream data source. They exist to:
  1. Hide upstream API keys server-side
  2. Work around CORS
  3. Add caching + per-IP rate limiting
  4. Normalize response shapes
Most proxies are intended for our own dashboard and are lightly gated. They are not part of the public API contract and may change or be removed without notice. Prefer the domain RPC services (/api/<domain>/v1/*) for stable integrations.

​
Raw-data passthroughs

All proxies:
  • Respect the origin CORS allowlist.
  • Apply per-IP rate limits via _ip-rate-limit.js (~ 60 req/min/IP default).
  • Cache aggressively (s-maxage varies by upstream).

​
Content proxies

​
GET /api/rss-proxy?url=<allowed-feed>

Fetches an RSS/Atom feed and returns the parsed JSON. The URL must match one of the patterns in _rss-allowed-domains.js — arbitrary URLs are refused to prevent SSRF.

​
Skills registry

​
GET /api/skills/fetch-agentskills

Returns the catalog of “skills” (agent capabilities) the WorldMonitor chat analyst can invoke. Used internally by chat-analyst.ts and the widget agent.

​
Legacy / internal

​
POST /api/fwdstart

Forward-starting scenario helper used by the desktop app during first-run. Internal.

​
GET /api/mcp-proxy

Legacy MCP shim — forwards to the current MCP route. Deprecated; use /api/mcp directly.