ISC · Permissive
Permissive, functionally equivalent to MIT with simplified wording. Common across the npm ecosystem and the default for packages created by npm itself.
Yes. The same license produces different obligations depending on whether the software is distributed, hosted, or kept internal. This is the distinction most dependency scanners collapse.
| How you ship it | Result | Why |
|---|---|---|
| Hosted SaaS | No obligation | ISC requires retaining the copyright notice and the license text. There is no source-disclosure obligation. |
| Distributed binary / app | No obligation | ISC requires retaining the copyright notice and the license text. There is no source-disclosure obligation. |
| Delivered to customer | No obligation | ISC requires retaining the copyright notice and the license text. There is no source-disclosure obligation. |
| Internal use only | No obligation | ISC requires retaining the copyright notice and the license text. There is no source-disclosure obligation. |
| Published library | No obligation | ISC requires retaining the copyright notice and the license text. There is no source-disclosure obligation. |
Attribution
As a build-time dependency it is a different question.
ISC appears as a dev dependency, so it is not part of the artifact you ship. Distribution-triggered obligations do not arise. Tools that emit code into your output, such as code generators, are a separate case worth checking individually.
ISC requires retaining the copyright notice and the license text. There is no source-disclosure obligation.
ISC requires retaining the copyright notice and the license text. There is no source-disclosure obligation.
ISC requires retaining the copyright notice and the license text. There is no source-disclosure obligation.
ISC requires retaining the copyright notice and the license text. There is no source-disclosure obligation.
ISC requires retaining the copyright notice and the license text. There is no source-disclosure obligation.
ISC appears as a dev dependency, so it is not part of the artifact you ship. Distribution-triggered obligations do not arise. Tools that emit code into your output, such as code generators, are a separate case worth checking individually.
Want to know whether anything in your project is under ISC?
Check your whole manifest →License data last reviewed .
LicenseGuard reports information derived from published license texts and dependency manifests. It is not legal advice and using it does not create an attorney-client relationship. Results reflect license metadata as declared; they do not identify every obligation or violation. Consult qualified counsel for decisions that matter.
Listed in the official MCP registry, on Glama and on Smithery. Source on GitHub (Apache-2.0).