Allowed Dependencies for Python, TypeScript, and Rust in the AI Engineering Curriculum

The AI Engineering curriculum enforces a strict dependency allow-list that permits only five Python packages, four TypeScript packages, and zero external Rust crates to ensure learners implement core algorithms from scratch rather than relying on library abstractions.

The rohitg00/ai-engineering-from-scratch repository maintains a zero-tolerance policy for extraneous dependencies. By restricting imports to a curated allow-list defined in AGENTS.md, the curriculum forces participants to engage with the underlying mathematics and systems concepts rather than calling high-level APIs. Any lesson code that imports modules outside this permitted set will fail the CI pipeline.

Python Allowed Dependencies

Python lessons in the curriculum may import from the standard library plus exactly five third-party packages. According to the Dependencies table in [AGENTS.md (lines 52-55)](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/AGENTS.md#L52-L55), the allowed packages are:

• numpy – for tensor algebra and numerical operations
• torch – for autograd and tensor computation primitives
• h5py – for HDF5 file format handling
• zstandard – for compression algorithms
• safetensors – for safe tensor serialization

These libraries provide the mathematical and data-handling primitives needed to implement neural-network components without hiding the underlying algorithms behind high-level abstractions.

Python Example

The following snippet from phases/01-intro-to-ml/01-linear-regression/code/main.py demonstrates compliant usage:

# phases/01-intro-to-ml/01-linear-regression/code/main.py

# ----------------------------------------------------

# Lesson: Linear Regression (Python)

# Allowed deps: numpy, torch, h5py, zstandard, safetensors, stdlib

import numpy as np

def predict(weights, X):
    """Simple linear model y = X·w + b."""
    return X @ weights

# ... rest of the lesson implementation

TypeScript Allowed Dependencies

TypeScript lessons operate under similar constraints but with different tooling. The allow-list covers lightweight HTTP routing and validation libraries necessary for building web agents. Per [AGENTS.md (line 55)](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/AGENTS.md#L55), permitted npm modules are:

• hono – for lightweight HTTP routing
• zod – for schema validation
• ws – for WebSocket support (only when required)
• @hono/node-server – for the server wrapper needed to run example agents

All lessons assume Node.js 20+, and no other npm modules are permitted.

TypeScript Example

This compliant import pattern appears in phases/02-web-agents/01-http-server/code/main.ts:

// phases/02-web-agents/01-http-server/code/main.ts
// ----------------------------------------------------
// Lesson: Minimal HTTP Server (TypeScript)
// Allowed deps: hono, zod, ws, @hono/node-server, stdlib

import { Hono } from 'hono';

const app = new Hono();

app.get('/', c => c.text('Hello from the AI curriculum!'));

export default app;

Rust Allowed Dependencies

Rust lessons follow the strictest rules: only the standard library is permitted. As documented in the Dependencies table in [AGENTS.md (line 56)](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/AGENTS.md#L56), learners must compile with rustc --edition 2021 using single-file compilation without external crates.

This restriction exposes learners to low-level memory and concurrency concepts without the convenience of crates like tokio or serde. The curriculum intentionally forces manual implementation of data structures and algorithms.

Rust Example

The phases/03-systems/01-memory-management/code/main.rs file demonstrates standard-library-only code:

// phases/03-systems/01-memory-management/code/main.rs
// ----------------------------------------------------
// Lesson: Manual Memory Management (Rust)
// Allowed deps: std only

fn main() {
    let mut data = vec![1, 2, 3, 4];
    for i in &mut data {
        *i *= 2;
    }
    println!("{:?}", data);
}

How the Allow-List is Enforced

The repository automates compliance checks through scripts/audit_lessons.py. This CI helper parses each lesson's code/ directory and aborts the build if any disallowed import is detected.

The audit script cross-references imports against the allow-list defined in AGENTS.md. If a lesson attempts to import pandas, express, or rand, the CI "audit" job will fail immediately, preventing the submission from merging.

Summary

• Python learners may use numpy, torch, h5py, zstandard, and safetensors alongside the standard library.
• TypeScript lessons are restricted to hono, zod, ws, and @hono/node-server on Node.js 20+.
• Rust implementations must compile with rustc --edition 2021 using only the standard library (std).
• The scripts/audit_lessons.py script enforces these rules automatically in CI.

Frequently Asked Questions

What happens if I import a package not on the allow-list?

The CI pipeline will fail. The scripts/audit_lessons.py script scans every lesson's code/ directory and detects disallowed imports. Any violation triggers a build failure, preventing the lesson from being accepted into the repository.

Can I request adding a new dependency to the curriculum?

The curriculum maintains a strict pedagogical philosophy focused on implementing concepts from scratch. While the AGENTS.md policy file could theoretically be updated, the maintainers prioritize keeping the dependency list minimal to ensure learners understand the underlying algorithms rather than calling high-level library functions.

Why does Rust have stricter rules than Python?

Rust lessons aim to teach low-level memory management, concurrency primitives, and systems programming concepts that would be obscured by convenience crates. By restricting dependencies to std only, the curriculum forces learners to implement data structures and algorithms manually, providing deeper insight into how high-level abstractions work under the hood.

Does the standard library count against the dependency limit?

No. The standard library is always permitted and does not count toward the external dependency limits. For Python, this includes modules like os, sys, and json; for TypeScript, the Node.js 20+ standard library; and for Rust, the full std crate including std::collections, std::sync, and std::io.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}