# Allowed Dependencies for Python in AI Engineering from Scratch: The Official Allowlist

> Discover the official allowed Python dependencies for AI Engineering from Scratch. Learn AI fundamentals with NumPy, Torch, h5py, zstandard, and safetensors. Focus on core concepts.

- Repository: [Rohit Ghumare/ai-engineering-from-scratch](https://github.com/rohitg00/ai-engineering-from-scratch)
- Tags: best-practices
- Published: 2026-08-28

---

**The AI Engineering from Scratch curriculum restricts Python dependencies to five external packages—NumPy, Torch, h5py, zstandard, and safetensors—plus the standard library, ensuring every lesson focuses on algorithmic fundamentals rather than external API surface area.**

The rohitg00/ai-engineering-from-scratch repository enforces a strict **dependency-allowlist policy** that defines exactly which **allowed dependencies for Python** may appear in lesson code. This constraint ensures learners build neural-network components from first principles using only essential mathematical and data-handling tools.

## Complete List of Allowed Python Dependencies

The curriculum permits exactly five external Python packages alongside the full standard library. These dependencies are categorized by function:

| Category | Allowed Package |
|----------|----------------|
| **Numerical computations** | `numpy` |
| **Deep learning frameworks** | `torch` |
| **HDF5 file handling** | `h5py` |
| **Compression utilities** | `zstandard` |
| **Safe tensor serialization** | `safetensors` |
| **Standard library** | All stdlib modules |

This constraint is defined in the **Dependencies** section of [`AGENTS.md`](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/AGENTS.md)【/cache/repos/github.com/rohitg00/ai-engineering-from-scratch/main/AGENTS.md#dependencies】. No other external packages may be imported in lesson code.

## How the Dependency Policy Is Enforced

The repository enforces these constraints through automated validation. The CI pipeline runs [`scripts/audit_lessons.py`](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/scripts/audit_lessons.py), which parses each lesson's [`requirements.txt`](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/requirements.txt) and import statements to detect prohibited packages. If a lesson attempts to import a library outside the allowlist—such as `pandas` or `scikit-learn`—the build fails immediately.

This validation ensures that examples like [`phases/01-intro-to-nn/01-matrix-multiplication/code/main.py`](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/phases/01-intro-to-nn/01-matrix-multiplication/code/main.py) remain **stdlib-first**, while advanced lessons such as [`phases/02-deep-learning/01-pytorch-basics/code/main.py`](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/phases/02-deep-learning/01-pytorch-basics/code/main.py) demonstrate minimal, justified use of `torch` within the permitted set.

## Why the Curriculum Limits Python Dependencies

The strict allowlist serves three architectural purposes:

- **Pedagogical clarity**: Restricting imports forces lessons to concentrate on matrix operations, back-propagation algorithms, and manual gradient calculations rather than high-level framework APIs.
- **Reproducibility**: The small dependency footprint creates a lightweight environment that runs identically on CI runners and student machines without version conflicts.
- **Future-proofing**: Core scientific packages like `numpy` and `torch` maintain stable APIs, reducing the risk of breaking changes that could invalidate lesson code over time.

## Practical Implementation Within the Constraints

The following examples demonstrate typical usage patterns that comply with the repository's dependency policy.

### Building Tensors with NumPy and Torch

This pattern uses NumPy for manual calculations and Torch for automatic differentiation:

```python
import numpy as np
import torch

# NumPy array for manual gradient calculation

x_np = np.array([[1.0, 2.0], [3.0, 4.0]], dtype=np.float32)
print("NumPy array:", x_np)

# Convert to a Torch tensor for automatic differentiation

x_torch = torch.tensor(x_np, requires_grad=True)
y = (x_torch ** 2).sum()
y.backward()
print("Gradient:", x_torch.grad)

```

### Safe Model Serialization with Safetensors

The curriculum permits `safetensors` for secure checkpoint handling without pickle vulnerabilities:

```python
import torch
from safetensors.torch import save_file, load_file

model = torch.nn.Linear(4, 2)
state = model.state_dict()

# Serialize safely

save_file(state, "model.safetensors")

# Load back

loaded_state = load_file("model.safetensors")
model.load_state_dict(loaded_state)

```

### Compressing Arrays with Zstandard

For data compression tasks within allowed dependencies:

```python
import numpy as np
import zstandard as zstd

arr = np.arange(1000, dtype=np.int32)
raw = arr.tobytes()

cctx = zstd.ZstdCompressor()
compressed = cctx.compress(raw)

dctx = zstd.ZstdDecompressor()
decompressed = np.frombuffer(dctx.decompress(compressed), dtype=np.int32)
print("Equal after round‑trip:", np.array_equal(arr, decompressed))

```

## Key Source Files Defining the Policy

| File | Purpose |
|------|---------|
| [`AGENTS.md`](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/AGENTS.md) | Master policy document listing allowed Python packages【/cache/repos/github.com/rohitg00/ai-engineering-from-scratch/main/AGENTS.md#dependencies】 |
| [`scripts/audit_lessons.py`](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/scripts/audit_lessons.py) | CI audit script that validates imports against the allowlist |
| [`phases/01-intro-to-nn/01-matrix-multiplication/code/main.py`](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/phases/01-intro-to-nn/01-matrix-multiplication/code/main.py) | Example lesson demonstrating NumPy-only implementation |
| [`phases/02-deep-learning/01-pytorch-basics/code/main.py`](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/phases/02-deep-learning/01-pytorch-basics/code/main.py) | Example lesson showing minimal Torch usage |

## Summary

- The **AI Engineering from Scratch** curriculum permits only five external Python packages: `numpy`, `torch`, `h5py`, `zstandard`, and `safetensors`.
- The **dependency allowlist** is formally defined in [`AGENTS.md`](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/AGENTS.md) and enforced by [`scripts/audit_lessons.py`](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/scripts/audit_lessons.py) during CI.
- This policy ensures lessons remain **stdlib-first**, focusing on fundamental algorithms rather than high-level library APIs.
- All lesson code must pass automated validation that fails the build if prohibited imports are detected.
- The restricted set ensures long-term stability and reproducibility across different computing environments.

## Frequently Asked Questions

### What happens if I try to use Pandas or Scikit-learn in a lesson?

The CI audit script [`scripts/audit_lessons.py`](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/scripts/audit_lessons.py) will detect the prohibited import and fail the build. The curriculum deliberately excludes data science convenience libraries to force implementation of algorithms from scratch using only `numpy` for numerical operations.

### Can I request additional packages be added to the allowlist?

The **AGENTS.md** policy is designed to remain stable. New dependencies are rarely added because each package increases the maintenance burden and distracts from core learning objectives. If a lesson requires specific functionality, implement it using the allowed packages or the standard library.

### Why is h5py included in the allowed dependencies?

`h5py` provides HDF5 file format support for handling large numerical datasets efficiently. While the standard library offers basic file I/O, `h5py` enables storage of multi-dimensional arrays common in neural network training data without introducing the complexity of full database systems or heavy data frameworks.

### Are there any exceptions for testing or development utilities?

The allowlist applies to lesson code specifically. Development dependencies used for repository maintenance—such as the audit script itself—may use additional packages, but the executable examples that learners run must strictly adhere to the five-package limit defined in **AGENTS.md**.