Allowed Dependencies for Python in AI Engineering from Scratch: The Official Allowlist

The AI Engineering from Scratch curriculum restricts Python dependencies to five external packages—NumPy, Torch, h5py, zstandard, and safetensors—plus the standard library, ensuring every lesson focuses on algorithmic fundamentals rather than external API surface area.

The rohitg00/ai-engineering-from-scratch repository enforces a strict dependency-allowlist policy that defines exactly which allowed dependencies for Python may appear in lesson code. This constraint ensures learners build neural-network components from first principles using only essential mathematical and data-handling tools.

Complete List of Allowed Python Dependencies

The curriculum permits exactly five external Python packages alongside the full standard library. These dependencies are categorized by function:

Category	Allowed Package
Numerical computations	numpy
Deep learning frameworks	torch
HDF5 file handling	h5py
Compression utilities	zstandard
Safe tensor serialization	safetensors
Standard library	All stdlib modules

This constraint is defined in the Dependencies section of AGENTS.md【/cache/repos/github.com/rohitg00/ai-engineering-from-scratch/main/AGENTS.md#dependencies】. No other external packages may be imported in lesson code.

How the Dependency Policy Is Enforced

The repository enforces these constraints through automated validation. The CI pipeline runs scripts/audit_lessons.py, which parses each lesson's requirements.txt and import statements to detect prohibited packages. If a lesson attempts to import a library outside the allowlist—such as pandas or scikit-learn—the build fails immediately.

This validation ensures that examples like phases/01-intro-to-nn/01-matrix-multiplication/code/main.py remain stdlib-first, while advanced lessons such as phases/02-deep-learning/01-pytorch-basics/code/main.py demonstrate minimal, justified use of torch within the permitted set.

Why the Curriculum Limits Python Dependencies

The strict allowlist serves three architectural purposes:

• Pedagogical clarity: Restricting imports forces lessons to concentrate on matrix operations, back-propagation algorithms, and manual gradient calculations rather than high-level framework APIs.
• Reproducibility: The small dependency footprint creates a lightweight environment that runs identically on CI runners and student machines without version conflicts.
• Future-proofing: Core scientific packages like numpy and torch maintain stable APIs, reducing the risk of breaking changes that could invalidate lesson code over time.

Practical Implementation Within the Constraints

The following examples demonstrate typical usage patterns that comply with the repository's dependency policy.

Building Tensors with NumPy and Torch

This pattern uses NumPy for manual calculations and Torch for automatic differentiation:

import numpy as np
import torch

# NumPy array for manual gradient calculation

x_np = np.array([[1.0, 2.0], [3.0, 4.0]], dtype=np.float32)
print("NumPy array:", x_np)

# Convert to a Torch tensor for automatic differentiation

x_torch = torch.tensor(x_np, requires_grad=True)
y = (x_torch ** 2).sum()
y.backward()
print("Gradient:", x_torch.grad)

Safe Model Serialization with Safetensors

The curriculum permits safetensors for secure checkpoint handling without pickle vulnerabilities:

import torch
from safetensors.torch import save_file, load_file

model = torch.nn.Linear(4, 2)
state = model.state_dict()

# Serialize safely

save_file(state, "model.safetensors")

# Load back

loaded_state = load_file("model.safetensors")
model.load_state_dict(loaded_state)

Compressing Arrays with Zstandard

For data compression tasks within allowed dependencies:

import numpy as np
import zstandard as zstd

arr = np.arange(1000, dtype=np.int32)
raw = arr.tobytes()

cctx = zstd.ZstdCompressor()
compressed = cctx.compress(raw)

dctx = zstd.ZstdDecompressor()
decompressed = np.frombuffer(dctx.decompress(compressed), dtype=np.int32)
print("Equal after round‑trip:", np.array_equal(arr, decompressed))

Key Source Files Defining the Policy

File	Purpose
AGENTS.md	Master policy document listing allowed Python packages【/cache/repos/github.com/rohitg00/ai-engineering-from-scratch/main/AGENTS.md#dependencies】
scripts/audit_lessons.py	CI audit script that validates imports against the allowlist
phases/01-intro-to-nn/01-matrix-multiplication/code/main.py	Example lesson demonstrating NumPy-only implementation
phases/02-deep-learning/01-pytorch-basics/code/main.py	Example lesson showing minimal Torch usage

Summary

• The AI Engineering from Scratch curriculum permits only five external Python packages: numpy, torch, h5py, zstandard, and safetensors.
• The dependency allowlist is formally defined in AGENTS.md and enforced by scripts/audit_lessons.py during CI.
• This policy ensures lessons remain stdlib-first, focusing on fundamental algorithms rather than high-level library APIs.
• All lesson code must pass automated validation that fails the build if prohibited imports are detected.
• The restricted set ensures long-term stability and reproducibility across different computing environments.

Frequently Asked Questions

What happens if I try to use Pandas or Scikit-learn in a lesson?

The CI audit script scripts/audit_lessons.py will detect the prohibited import and fail the build. The curriculum deliberately excludes data science convenience libraries to force implementation of algorithms from scratch using only numpy for numerical operations.

Can I request additional packages be added to the allowlist?

The AGENTS.md policy is designed to remain stable. New dependencies are rarely added because each package increases the maintenance burden and distracts from core learning objectives. If a lesson requires specific functionality, implement it using the allowed packages or the standard library.

Why is h5py included in the allowed dependencies?

h5py provides HDF5 file format support for handling large numerical datasets efficiently. While the standard library offers basic file I/O, h5py enables storage of multi-dimensional arrays common in neural network training data without introducing the complexity of full database systems or heavy data frameworks.

Are there any exceptions for testing or development utilities?

The allowlist applies to lesson code specifically. Development dependencies used for repository maintenance—such as the audit script itself—may use additional packages, but the executable examples that learners run must strictly adhere to the five-package limit defined in AGENTS.md.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}