# Allowed Dependencies for Python, TypeScript, and Rust in the AI Engineering Curriculum

> Discover the limited allowed dependencies for Python, TypeScript, and Rust in the AI Engineering curriculum. Implement core algorithms from scratch without library abstractions.

- Repository: [Rohit Ghumare/ai-engineering-from-scratch](https://github.com/rohitg00/ai-engineering-from-scratch)
- Tags: best-practices
- Published: 2026-06-20

---

**The AI Engineering curriculum enforces a strict dependency allow-list that permits only five Python packages, four TypeScript packages, and zero external Rust crates to ensure learners implement core algorithms from scratch rather than relying on library abstractions.**

The rohitg00/ai-engineering-from-scratch repository maintains a zero-tolerance policy for extraneous dependencies. By restricting imports to a curated allow-list defined in [`AGENTS.md`](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/AGENTS.md), the curriculum forces participants to engage with the underlying mathematics and systems concepts rather than calling high-level APIs. Any lesson code that imports modules outside this permitted set will fail the CI pipeline.

## Python Allowed Dependencies

Python lessons in the curriculum may import from the standard library plus exactly five third-party packages. According to the **Dependencies** table in [[`AGENTS.md`](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/AGENTS.md) (lines 52-55)](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/AGENTS.md#L52-L55), the allowed packages are:

- **`numpy`** – for tensor algebra and numerical operations
- **`torch`** – for autograd and tensor computation primitives
- **`h5py`** – for HDF5 file format handling
- **`zstandard`** – for compression algorithms
- **`safetensors`** – for safe tensor serialization

These libraries provide the mathematical and data-handling primitives needed to implement neural-network components without hiding the underlying algorithms behind high-level abstractions.

### Python Example

The following snippet from [`phases/01-intro-to-ml/01-linear-regression/code/main.py`](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/phases/01-intro-to-ml/01-linear-regression/code/main.py) demonstrates compliant usage:

```python

# phases/01-intro-to-ml/01-linear-regression/code/main.py

# ----------------------------------------------------

# Lesson: Linear Regression (Python)

# Allowed deps: numpy, torch, h5py, zstandard, safetensors, stdlib

import numpy as np

def predict(weights, X):
    """Simple linear model y = X·w + b."""
    return X @ weights

# ... rest of the lesson implementation

```

## TypeScript Allowed Dependencies

TypeScript lessons operate under similar constraints but with different tooling. The allow-list covers lightweight HTTP routing and validation libraries necessary for building web agents. Per [[`AGENTS.md`](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/AGENTS.md) (line 55)](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/AGENTS.md#L55), permitted npm modules are:

- **`hono`** – for lightweight HTTP routing
- **`zod`** – for schema validation
- **`ws`** – for WebSocket support (only when required)
- **`@hono/node-server`** – for the server wrapper needed to run example agents

All lessons assume **Node.js 20+**, and no other npm modules are permitted.

### TypeScript Example

This compliant import pattern appears in [`phases/02-web-agents/01-http-server/code/main.ts`](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/phases/02-web-agents/01-http-server/code/main.ts):

```typescript
// phases/02-web-agents/01-http-server/code/main.ts
// ----------------------------------------------------
// Lesson: Minimal HTTP Server (TypeScript)
// Allowed deps: hono, zod, ws, @hono/node-server, stdlib

import { Hono } from 'hono';

const app = new Hono();

app.get('/', c => c.text('Hello from the AI curriculum!'));

export default app;

```

## Rust Allowed Dependencies

Rust lessons follow the strictest rules: **only the standard library** is permitted. As documented in the **Dependencies** table in [[`AGENTS.md`](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/AGENTS.md) (line 56)](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/AGENTS.md#L56), learners must compile with `rustc --edition 2021` using single-file compilation without external crates.

This restriction exposes learners to low-level memory and concurrency concepts without the convenience of crates like `tokio` or `serde`. The curriculum intentionally forces manual implementation of data structures and algorithms.

### Rust Example

The [`phases/03-systems/01-memory-management/code/main.rs`](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/phases/03-systems/01-memory-management/code/main.rs) file demonstrates standard-library-only code:

```rust
// phases/03-systems/01-memory-management/code/main.rs
// ----------------------------------------------------
// Lesson: Manual Memory Management (Rust)
// Allowed deps: std only

fn main() {
    let mut data = vec![1, 2, 3, 4];
    for i in &mut data {
        *i *= 2;
    }
    println!("{:?}", data);
}

```

## How the Allow-List is Enforced

The repository automates compliance checks through [`scripts/audit_lessons.py`](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/scripts/audit_lessons.py). This CI helper parses each lesson's `code/` directory and aborts the build if any disallowed import is detected.

The audit script cross-references imports against the allow-list defined in [`AGENTS.md`](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/AGENTS.md). If a lesson attempts to import `pandas`, `express`, or `rand`, the CI "audit" job will fail immediately, preventing the submission from merging.

## Summary

- **Python** learners may use `numpy`, `torch`, `h5py`, `zstandard`, and `safetensors` alongside the standard library.
- **TypeScript** lessons are restricted to `hono`, `zod`, `ws`, and `@hono/node-server` on Node.js 20+.
- **Rust** implementations must compile with `rustc --edition 2021` using only the standard library (`std`).
- The [`scripts/audit_lessons.py`](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/scripts/audit_lessons.py) script enforces these rules automatically in CI.

## Frequently Asked Questions

### What happens if I import a package not on the allow-list?

The CI pipeline will fail. The [`scripts/audit_lessons.py`](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/scripts/audit_lessons.py) script scans every lesson's `code/` directory and detects disallowed imports. Any violation triggers a build failure, preventing the lesson from being accepted into the repository.

### Can I request adding a new dependency to the curriculum?

The curriculum maintains a strict pedagogical philosophy focused on implementing concepts from scratch. While the [`AGENTS.md`](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/AGENTS.md) policy file could theoretically be updated, the maintainers prioritize keeping the dependency list minimal to ensure learners understand the underlying algorithms rather than calling high-level library functions.

### Why does Rust have stricter rules than Python?

Rust lessons aim to teach low-level memory management, concurrency primitives, and systems programming concepts that would be obscured by convenience crates. By restricting dependencies to `std` only, the curriculum forces learners to implement data structures and algorithms manually, providing deeper insight into how high-level abstractions work under the hood.

### Does the standard library count against the dependency limit?

No. The standard library is always permitted and does not count toward the external dependency limits. For Python, this includes modules like `os`, `sys`, and `json`; for TypeScript, the Node.js 20+ standard library; and for Rust, the full `std` crate including `std::collections`, `std::sync`, and `std::io`.