json-rules-engine

Quick Summary

json-rules-engine is a lightweight JavaScript/Node.js rules engine that stores rules as plain JSON — conditions and events described in a human-readable structure, evaluated against facts at runtime. It runs isomorphically in both Node.js and the browser. Conditions support ALL/ANY recursive nesting for complex boolean logic, async fact fetching with caching prevents redundant calls, and the 17kb minified footprint makes it practical even in client-side contexts. For teams needing simple rule evaluation embedded in a JavaScript application — content personalization, form validation, lightweight pricing logic — it solves the problem with minimal overhead.

The library has been effectively unmaintained since November 2023. At the time of writing, 61 open issues sit unaddressed and 7 pull requests await review with no maintainer activity. There is no commercial entity behind the project, no roadmap, and no active development community with the capacity to address discovered issues. Teams building new systems on json-rules-engine in 2026 are committing to a frozen dependency — one that will never gain a visual editor, never add governance, never integrate with modern AI tooling, and never receive security patches without team-level forking and self-maintenance.

The deeper issue is what json-rules-engine doesn't provide: no visual authoring interface, no decision table editor, no hosted service, no audit trail, no RBAC, and no approval workflow. Every rule change requires a developer to edit a JSON file (or the code that generates it), commit, and deploy. The $0 license is genuine. The ≥$70K Year 1 TCO reflects what teams actually pay when they count implementation work, infrastructure, the developer-time tax on every rule change, and the ongoing cost of operating a frozen dependency in production.

What Is json-rules-engine?

json-rules-engine is a JavaScript library that evaluates rules — expressed as JSON objects containing condition trees and event definitions — against a set of named facts. Core components:

• JSON rule format — rules are plain JavaScript objects (or JSON files) with conditions (ALL/ANY nested boolean trees) and events (what fires when conditions pass)
• Condition operators — built-in comparators (equal, notEqual, lessThan, greaterThanInclusive, etc.) plus custom operator registration
• Fact caching — facts can be functions (synchronous or async); the engine caches results per-run to avoid redundant database or API calls when the same fact is referenced by multiple rules
• ALL/ANY recursive nesting — condition trees can nest ALL-within-ANY and ANY-within-ALL to arbitrary depth, covering complex boolean logic without custom code
• Isomorphic execution — runs identically in Node.js and browser environments; the same rule set works in both contexts
• Priority-ordered evaluation — rules evaluate in configurable priority order; stop-on-first-match behavior is configurable

There is no authoring UI, no decision table, no governance layer, no versioning, and no persistence. json-rules-engine solves one problem — JSON-described rule evaluation in-process in JavaScript — and leaves everything else to the implementing team.

How We Analyzed json-rules-engine's Abilities

For this review, we focused on what actually determines whether a team can responsibly run production decisioning on json-rules-engine in 2026 — not whether async fact caching works in a unit test, but whether the project and the operational model around it can support a real business over time.

Our analysis draws from the json-rules-engine GitHub repository (commit history, issue tracker, npm download data), Stack Overflow threads, and real-world engineering estimates modeled at production scale.

How json-rules-engine Works

json-rules-engine uses a sequential rule evaluation model. When the engine runs:

1. Rule Definition: Developers define rules as JavaScript objects or JSON files with conditions (boolean trees using ALL/ANY nesting and comparison operators) and events (name-and-params objects that fire when conditions pass).

2. Engine Initialization: Rules are added to an Engine instance at startup. Custom operators and fact definitions can be registered at this point.

3. Fact Population: Facts are either static values or dynamic functions (sync or async). Async fact functions are invoked by the engine and their results cached for the duration of a single run.

4. Sequential Evaluation: The engine evaluates all registered rules in priority order against the current fact set. Condition trees are walked recursively; for async facts, the engine awaits resolution before proceeding.

5. Event Emission: When a rule's conditions pass, the engine emits its event object. The calling code registers event listeners that handle the output — there is no built-in output format or persistence.

6. Change Management: A rule change means modifying the JSON/JS definition, committing to version control, and redeploying whatever service hosts the engine. There is no built-in test harness, simulation mode, or staging environment concept.

Who Uses json-rules-engine?

json-rules-engine is found in:

JavaScript monoliths and Node.js services: Backend teams that needed simple rule evaluation inside an existing Express or Fastify service without adding a language boundary.

Client-side decisioning: The isomorphic design made it attractive for browser-based personalization or form logic — routing users through different flows based on evaluated conditions without a server round-trip.

Prototype and proof-of-concept: Developers exploring whether rule engine patterns fit their use case, using json-rules-engine as a low-friction starting point.

Teams that have moved on but haven't replaced it yet: Many codebases contain json-rules-engine for legacy rule sets that are stable enough to not justify migration but not strategically important enough to prioritize.

Reviews

Pros:

• Rules stored as JSON are human-readable — a developer can diff a rule change in a pull request and understand what changed without deciphering code
• Async fact support with per-run caching — facts can be database or API calls; the engine caches results within a run to avoid redundant calls when multiple rules reference the same fact
• Isomorphic JavaScript — the same rule set and engine run identically in Node.js and the browser without any adaptation
• ALL/ANY recursive nesting — conditions can be nested to arbitrary depth, covering complex boolean policy logic without custom operator code
• Zero cost to adopt — ISC license, 17kb minified footprint, available on npm with no vendor or procurement process

---

JavaScript Developer on npm Community

For small, stable rule sets inside a Node service, json-rules-engine is genuinely pleasant to work with. The JSON format means the conditions are readable in code review, the async fact caching is well-designed, and the ALL/ANY nesting handles real policy logic without gymnastics. If the library were actively maintained, I'd have fewer reservations recommending it.

Verified User on Reddit r/javascript

The isomorphic design was the main reason we chose it — same rule evaluation in the browser for UX decisions and in Node for authoritative backend processing. That part works well. The problem is that you're still writing JSON by hand; the "human-readable" claim only really holds for developers. A product manager looking at a nested ALL/ANY condition tree is not going to self-serve that. We still gate every change.

Verified Community Reviews

Cons:

• Business users cannot author JSON — a nested ALL/ANY condition object is still developer territory; there is no visual interface for non-technical users
• Unmaintained since November 2023 — 61 open issues and 7 pull requests sit with no maintainer response; the project is effectively abandoned
• No visual editor in the core library — a community JSON Rules Editor exists (vinzdeveloper/json-rule-editor) but is not maintained by the core team; it requires a separate integration project and provides no governance, versioning, or auth
• No workflow or chaining — each engine run is an isolated stateless evaluation; multi-step decision flows and Human-in-the-Loop patterns require custom orchestration
• No governance or audit trail — the library stores nothing about what fired, against what data, at what time; compliance evidence requires a full custom build
• No AI or MCP integration — frozen at the late-2023 state of the ecosystem; no natural language rule creation, no agent integration, no AI-assisted authoring

---

Developer on GitHub Issues

Opened a bug report in December 2023. No response, no activity, nothing. There are 60+ other issues in the same state. The maintainer has clearly moved on. This library is dead. If you're starting a new project, do not use it — you will own all maintenance forever with no upstream help. If you're already running it, start planning a migration.

Engineering Lead on Hacker News

We built a pricing rules system on json-rules-engine. The library works fine for evaluation, but we ended up building a full admin interface, audit log, versioning system, and approval workflow on top of it — basically everything a real rules platform ships. We spent more engineering time on the surrounding infrastructure than we ever would have spent on a platform license. Hindsight: we should have paid for a platform from day one.

Verified Community Reviews

In-Depth json-rules-engine Features Analysis

1. Execution & Scale

For small, stable rule sets in a Node.js service, json-rules-engine's in-process evaluation is low-latency. There is no network round-trip to an external rules service, and async fact caching within a run prevents redundant calls for facts referenced by multiple rules. When the rule set is compact — dozens of rules with a few conditions each — this model is efficient.

Performance degrades as rule sets grow. json-rules-engine evaluates rules sequentially — every rule is checked on every engine fire. There is no indexing, no Rete network optimization, and no incremental matching. At high TPS with large rule sets, the evaluation cost scales linearly with rule count. Scaling the decisioning layer means scaling the Node.js application — there are no engine-specific scaling primitives, clustering support, or session isolation mechanisms.

Strengths:

• In-process JavaScript execution avoids external latency — for low-volume, small rule sets embedded in an existing Node.js service, running in-process is faster than calling an external service.
• Async fact caching within a single run prevents redundant API or database calls — a fact used by five different rules is fetched once and reused.
• Isomorphic execution enables client-side use cases — the same rule logic can run in the browser for fast UX decisions without a server round-trip.
• Stateless evaluation is easy to reason about — each engine invocation is independent; no shared state between calls, which simplifies concurrency.

Drawbacks:

• Sequential evaluation with no optimization degrades linearly with rule count — at high TPS with large rule sets, the performance ceiling is fundamental to the design, not a fixable issue.
• No auto-scaling — scaling means scaling the entire Node.js application; there is no decisioning-layer-specific scaling mechanism.
• No active maintainer to address performance issues — performance bugs or regressions discovered in production have no upstream path to resolution.
• Stateless-only design eliminates multi-step use cases — any decision flow requiring accumulated state, Human-in-the-Loop, or event-driven fact accumulation requires custom orchestration.

2. Build & Author

json-rules-engine rules are JSON — developer-readable in code review, but not business-user-accessible in practice. A nested ALL/ANY condition tree with comparison operators and async fact references is understandable to an engineer reviewing a pull request, but is not something a product manager, compliance analyst, or pricing actuary can safely write, read, or modify without assistance. Every rule change routes through engineering.

This creates a permanent gating problem. Even for rule logic that is genuinely owned by the business — pricing thresholds, eligibility criteria, content targeting conditions — the business team must file a ticket, a developer must translate requirements into JSON, and the change must go through a code review and deployment cycle before taking effect. The $0 library cost is real. The permanent developer-time tax on every business-owned rule change is also real, and it compounds indefinitely.

Strengths:

• JSON conditions are diff-able and code-reviewable — changes to rule conditions are visible as structured JSON diffs in pull requests; the intent of a change is easier to read than opaque binary formats.
• ALL/ANY recursive nesting handles complex boolean logic — deep nested condition trees covering real policy logic without custom operator implementations.
• Custom operator registration — teams can extend the built-in operator set with domain-specific comparison functions registered at engine initialization.
• Priority ordering allows first-match and ordered evaluation patterns — configurable rule priority and stop-on-first-match behavior covers common routing logic patterns.

Drawbacks:

• Zero authoring path for non-engineers — every rule is JSON or generated JavaScript; business teams cannot self-serve any rule changes.
• No decision tables — tabular policies must be expressed as individual rule objects; there is no built-in table-style authoring.
• No formula or expression editor — condition values must be hard-coded in the JSON; there is no formula syntax for derived values or computed thresholds.
• No AI rule authoring — no natural language input, no copilot, no AI assistance; frozen at the late-2023 state of the authoring ecosystem.
• No visual editor anywhere in the ecosystem — unlike more established rule engines, json-rules-engine has never had a third-party visual authoring tool reach maturity.

3. Operate & Govern

json-rules-engine ships zero governance capabilities. No users, no roles, no approvals, no versions, no environments. Every governance requirement — maker-checker approval, RBAC, audit logs, versioning, rollback — is a custom build project using Git and whatever infrastructure the team can wire together. These custom builds work at small scale for developer-owned systems. They do not satisfy compliance auditors who need formal evidence of rule change approvals, or engineering teams that need to quickly roll back a bad rule change without a full application redeployment.

Strengths:

• Git history provides a basic version record — if rules are stored in version-controlled files, commit history shows who changed what and when.
• Code review as a lightweight approval gate — PRs provide a review record that can serve basic compliance purposes in low-stakes environments.

Drawbacks:

• No native approval flows — rules go live at deployment; there is no pre-deployment approval step built into the system.
• No RBAC — repository and deployment access control is the only role separation; any developer with deploy access can change any rule.
• No execution audit trail — the library does not log what rules fired, against what data, for what decision; any audit evidence requires a custom logging project.
• No one-click rollback — reverting a bad rule change means reverting a git commit, rebuilding, and redeploying the application.
• No environment promotion — dev-to-staging-to-production is whatever the team's CI/CD pipeline does; there is no rule-specific staging and promotion concept.

4. Integrations & API

json-rules-engine has no integration layer. Facts can be async functions that fetch data from anywhere a JavaScript promise can reach, but the implementation of those fetches is entirely custom code that the team writes, maintains, and operates. There is no connector catalog, no webhook system, and no scheduler. Other services cannot call json-rules-engine as a REST endpoint without the team building that HTTP wrapper themselves.

Strengths:

• Async fact functions can fetch from any JavaScript-reachable data source — HTTP APIs, database queries, Redis calls — with native Promise support.
• Per-run fact caching means multi-rule fact sharing is free — teams can use the same async fact across many rules without penalty.

Drawbacks:

• No connector catalog — every data source integration is a custom development and maintenance project.
• No REST API for rules-as-a-service — json-rules-engine is a library; other services cannot call it as an endpoint without a custom HTTP wrapper.
• No webhooks or scheduler — evaluation is triggered by application code; event-driven and scheduled execution require custom orchestration.
• No import/export — there is no standard migration format; moving rule sets to another platform requires manual reconstruction.
• Multi-source data means multiple custom async fact functions — every new data source is a new integration project.

5. Support / SLA

There is no support for json-rules-engine. The GitHub issue tracker has 61 open issues with no recent maintainer activity. No commercial entity, no support email, no SLA, no enterprise tier. When something breaks — or when a security vulnerability is discovered in the library or its dependencies — the team is on its own.

Strengths:

• The codebase is small enough to be readable — a skilled JavaScript team can understand the entire engine, lowering the barrier to self-support and self-patching.
• ISC license permits forking — teams can maintain their own patched fork; no license restriction prevents this.
• npm documentation and older Stack Overflow answers remain useful — the API is stable and archived answers about common usage patterns still apply.

Drawbacks:

• No active maintainer — 61 open issues with no response since late 2023; there is no path to getting a bug addressed from the project.
• No SLA of any kind — uptime and reliability are the team's own infrastructure responsibility.
• No migration assistance — moving to another platform is a self-owned engineering project.
• Vulnerability response is undefined — if a security issue is found, the team must patch their own fork or migrate; there is no upstream fix coming.
• No training programs — no structured onboarding, no certification; the README is the entire documentation surface.

6. Security & Compliance

json-rules-engine carries no compliance certification. Compliance posture is the implementing team's responsibility — SOC 2, ISO 27001, and GDPR controls must be built and maintained at the application layer. For organizations with vendor risk management programs, "unmaintained since November 2023" is increasingly flagged as a supply chain risk independent of any specific known vulnerability — a dependency with no active maintainer cannot respond to newly discovered CVEs.

Strengths:

• Deployment flexibility — runs wherever Node.js runs; no platform constraints from the library itself.
• No external network calls from the engine — the library makes no outbound connections; all data handling is under the implementing team's control.

Drawbacks:

• No SOC 2, ISO 27001, or GDPR certification — all compliance is the team's responsibility.
• No multi-tenancy — the library has no concept of tenants or per-tenant rule isolation; multi-tenancy must be built at the application layer.
• Security and access controls are entirely the team's responsibility — no encryption, no authentication, no access control ships with the library.
• Vulnerability response is undefined — no active maintainer means newly discovered CVEs may never get patched upstream.

7. Logs / History / Reports

json-rules-engine emits success and failure events per rule, and the engine instance emits rule result events the calling code can listen to. This is the closest the library comes to execution tracing — developer-implemented event listeners piped to whatever logging infrastructure the team maintains. The library stores nothing. There is no audit trail, no analytics dashboard, no reason-code generation, and no retention of any kind built in.

Strengths:

• Rule-result event emission provides a hook — the engine emits success/failure events per rule that can be piped to a custom logging destination.
• Rule results include condition detail — the result object includes which conditions passed and failed, providing raw material for custom explainability logging.

Drawbacks:

• No built-in audit trail — event emission plus storage plus querying is entirely a custom build; the library provides only the first piece.
• No analytics dashboard — rule execution volume, outcome distributions, and latency trends require external tooling built by the team.
• No explainability or reason codes — structured natural-language explanations for decisions must be manually coded into event handlers.
• No log retention — the library stores nothing; retention is whatever the hosting infrastructure provides.
• No organization tools — rule sets are managed as JavaScript objects or JSON files in a code repository; there is no native search, tagging, or taxonomy support.

Pricing

json-rules-engine is free — ISC license, available on npm at 17kb minified, zero cost to adopt. The real cost is the implementation work, the infrastructure to host a Node.js rules service, the permanent developer-time tax on every rule change that business users cannot self-serve, and the growing maintenance burden of an unmaintained frozen dependency. Year 1 TCO at 100 TPS reflects those real costs.

Total Cost of Ownership Comparison

What the Numbers Actually Mean

json-rules-engine's ≥$70K Year 1 is lower than GoRules (≥$250K) and Nools (≥$320K) because it is a lightweight JavaScript library with simple implementation and minimal infrastructure overhead. The cost is primarily engineering time: implementing the surrounding infrastructure — HTTP wrapper, logging, governance, connectors — that the library doesn't ship.

Nected at ≥$20K Year 1 costs less in total because the license covers governance, connectors, business-user authoring, and managed infrastructure. The platform eliminates the permanent developer-time tax on rule changes and removes the ongoing maintenance burden of a frozen dependency. At ≥$60K over three years versus ≥$200K for json-rules-engine, the math is not close — even counting the license cost.

Top 3 json-rules-engine Alternatives

The three most commonly evaluated alternatives when json-rules-engine doesn't fit — or when teams outgrow the library model entirely. Nected is the complete platform play: business users author rules in a visual editor, governance ships on day one, and Year 1 TCO starts at ≥$20K versus json-rules-engine's ≥$70K when you count implementation and ops. GoRules is the most realistic like-for-like swap for engineering teams who want to stay open-source and cross-stack but need an actively maintained codebase — it is maintained, it has a modern interface, and it works beyond JavaScript, though governance and connectors still require a custom build. Nools is a JavaScript Rete engine in the same unmaintained open-source tier as json-rules-engine — it adds forward-chaining capability but carries the same abandonment risk; switching to it is a lateral move, not a step forward.

Looking for the full list of json-rules-engine alternatives? See our deep-dive → Top 10 json-rules-engine Alternatives for 2026

Why Teams Compare Nected Against json-rules-engine

When teams evaluate json-rules-engine — or run it in production and hit its limits — four things consistently drive the comparison with Nected:

JSON rules are developer territory, not business-user-readable: JSON conditions look approachable, but a nested ALL/ANY condition tree with async fact references is not something a product manager or compliance analyst can safely author, review, or change without developer assistance. Every rule update routes through engineering — a ticket, a JSON edit, a PR, a deploy. Nected gives ops and product teams a visual editor where they define and change rules themselves, without touching JSON or opening a ticket.

Effectively dead since November 2023: json-rules-engine's last release was November 2023. Sixty-one open issues and seven pull requests sit with no maintainer response. The project is abandoned. Teams adopting it in 2026 are committing to a frozen dependency that will never receive security patches, never gain AI tooling, and never improve. Nected ships new capabilities continuously — AI copilot, MCP integration, auto-scaling — on an active, supported platform with a roadmap.

No governance, no audit trail — compliance evidence is a custom build: json-rules-engine stores nothing. When a rule fires incorrectly, there is no built-in log of what ran, against what data, at what time. Audit trails, versioning, RBAC, and approval flows are all custom engineering projects on top of an unmaintained library. Nected ships audit logs, rule versioning, RBAC, and approval workflows from day one, on every plan.

$0 license, ≥$70K Year 1 reality: The ISC license costs nothing. Implementation, ops, governance build, and developer-time on every business rule change are not free. At 100 TPS, the true Year 1 cost is ≥$70K and grows to ≥$200K over three years. Nected at ≥$60K over three years includes governance, connectors, and managed infrastructure — less in total, more included from day one.

Final Verdict

json-rules-engine is a well-designed library for the problem it was built to solve: lightweight, JSON-described rule evaluation in JavaScript. For compact, stable rule sets embedded in a developer-owned Node.js service with no compliance requirements and no expectation of business-user participation, it works.

For most teams evaluating rules engines in 2026, json-rules-engine is the wrong foundation. It has been effectively unmaintained since November 2023. Business users cannot touch rules. Governance, audit trails, versioning, and connectors require substantial custom builds on top of an abandoned dependency. The $0 license is real; the ≥$70K Year 1 TCO and ≥$200K three-year cost are also real.

Nected at ≥$20K Year 1 is a better total cost despite the license — because the platform covers governance, connectors, business-team authoring, and managed infrastructure that json-rules-engine forces teams to build and maintain indefinitely on a frozen dependency.