The JSON license is an MIT style license with one extra sentence: The Software shall be used for Good, not Evil. Because that sentence is not a standard permission, scanners usually mark it custom or non-standard. Treat it as a review item, decide once as a policy, and record the decision.
What the text contains
The license text published at json.org is short. It grants permission to use, copy, modify, merge, publish, distribute, sublicense and sell the software, on the condition that the copyright and permission notice appear in all copies. It then adds the line that the software shall be used for Good, not Evil, followed by the usual warranty disclaimer.
Everything except that one line matches the familiar MIT shape. That is why detection tools often label it as "MIT-like" or "custom".
Why it is a review item
A condition that depends on a moral judgement is hard to test. Many organizations do not want to decide, case by case, whether their use fits it. That is a policy matter, and some teams simply prefer to avoid packages carrying it. Others accept it. Either is a legitimate decision as long as it is deliberate.
This post is not legal advice. If your counsel has a view, follow it.
A decision guide
| Situation | Reasonable action |
|---|---|
| Found in a build tool that never ships | Allow with a note |
| Found in a runtime library, easy to replace | Replace it |
| Found in a runtime library, hard to replace | Escalate to counsel, record the answer |
| Appears in many repos | Write one policy line and apply it everywhere |
How to make it repeatable
- Name the license in your policy. Give it an identifier you use internally, for example a LicenseRef style label, so the scanner result is consistent.
- Pick a tier. Most teams put it in the review tier, not allow and not deny.
- Set an expiry on exceptions. A time limited exception forces a second look.
- Check the replacement path. Often the same functionality exists in a package with a standard license.
- Record the owner. Someone should be named as the decision maker.
If you use SPDX documents, a license that is not on the SPDX list can be recorded with a LicenseRef entry plus its text. See recording licenses that are not on the SPDX list.
What a scanner can and cannot do
A scanner can find the text and flag that it differs from MIT. It cannot judge whether your use is Good. That part belongs to people.
Quick check
Is the JSON license the same as MIT?
No. It matches MIT apart from one added sentence, so it is a separate license.
Should I block it automatically?
Route it to review. Blocking by default may be right for your policy, but make that a choice.
Safeguard's policies and gates let you set that tier once and apply it to pull requests.
Sources
Last reviewed: 19 October 2026.
