Allowed Dependencies for AI Engineering From Scratch: The Complete Allow-List

AI Engineering From Scratch permits only specific third-party packages—numpy, torch, h5py, zstandard, and safetensors for Python; hono, zod, ws, and @hono/node-server for TypeScript—while restricting Rust and Julia to their standard libraries to enforce a strict "stdlib-first" educational policy.

The rohitg00/ai-engineering-from-scratch repository maintains a curated dependency allow-list to keep the curriculum focused on fundamentals rather than framework abstractions. This policy is documented in the AGENTS.md file and enforced through automated auditing scripts. Understanding these constraints ensures your contributions align with the repository’s educational philosophy.

The Stdlib-First Policy

The repository follows a strict "stdlib-first" mandate designed to maximize learning by minimizing hidden complexity. This approach requires learners to implement algorithms from scratch rather than relying on high-level abstractions. Any deviation from the approved dependency list must be justified with the explicit reason: "stays stdlib-first for educational clarity."

Allowed Dependencies by Language

The definitive allow-list is located in AGENTS.md at lines 52-57. Each language tier has specific permitted packages that complement—but do not replace—standard library capabilities.

Python Dependencies

Python code may use the standard library plus five specific third-party packages:

• numpy – for numerical computing foundations
• torch – for tensor operations and deep learning primitives
• h5py – for HDF5 file format interaction
• zstandard – for compression algorithms
• safetensors – for secure tensor serialization

This constraint ensures that while learners can leverage performance-optimized primitives, they still write the high-level algorithmic logic themselves.

TypeScript Dependencies

TypeScript implementations targeting Node 20+ may use:

• hono – lightweight web framework
• zod – schema validation library
• ws – WebSocket library (only when WebSocket functionality is explicitly required)
• @hono/node-server – Node.js adapter for Hono

All other functionality must rely on the Node.js 20+ standard library.

Rust Dependencies

Rust code is restricted to the standard library only. All examples must compile as single-file programs using rustc --edition 2021 without external crates. This constraint forces manual memory management and algorithm implementation without cargo dependency resolution.

Julia Dependencies

Julia code may use select standard library modules:

• Random – for reproducible random number generation
• Statistics – for statistical operations
• LinearAlgebra – for matrix operations
• Printf – for formatted output

No external Julia packages are permitted.

Enforcement and Verification

The repository enforces these constraints through automated tooling. The scripts/audit_lessons.py file contains validation logic that scans lesson submissions for unauthorized imports or package references.

The canonical reference resides in AGENTS.md, which contributors must consult before submitting code. The README.md provides the public entry point linking to each lesson and cross-referencing the dependency policy.

Practical Examples

Here are minimal examples demonstrating compliant dependency usage for each supported language:

Python using permitted numpy:

import numpy as np

def normalize(v):
    """Simple L2-norm using NumPy."""
    return v / np.linalg.norm(v)

print(normalize(np.array([1, 2, 3])))

TypeScript using the allowed hono framework:

import { Hono } from "hono";

const app = new Hono();

app.get("/", c => c.text("Hello from AI Engineering!"));

export default {
  fetch: app.fetch,
};

Rust using only the standard library:

fn main() {
    println!("Hello from AI Engineering (Rust)");
}

Julia using the allowed Random module:

using Random

function sample_vector(n)
    rand(Random.GLOBAL_RNG, n)
end

println(sample_vector(5))

Summary

• AI Engineering From Scratch maintains a strict allow-list to preserve educational value.
• Python permits numpy, torch, h5py, zstandard, and safetensors plus the standard library.
• TypeScript permits hono, zod, ws (conditional), and @hono/node-server plus Node 20+ stdlib.
• Rust allows only the standard library (rustc --edition 2021).
• Juliaallows only Random, Statistics, LinearAlgebra, and Printf from the standard library.
• Violations are caught by scripts/audit_lessons.py as defined in AGENTS.md.

Frequently Asked Questions

Why does AI Engineering From Scratch restrict dependencies?

The restriction ensures learners understand foundational algorithms by implementing them manually rather than calling high-level APIs. This "stdlib-first" approach prevents "dependency magic" from obscuring the mechanics of AI engineering.

Can I use PyTorch Lightning or Keras in this repository?

No. While torch is permitted for tensor operations, high-level frameworks like PyTorch Lightning, Keras, or FastAI are explicitly prohibited. The policy requires writing training loops, optimizers, and layers from scratch using only base torch primitives.

How do I verify my code meets the dependency requirements?

Run the scripts/audit_lessons.py script locally before submitting. This tool parses your imports and flags any packages outside the allow-list defined in AGENTS.md lines 52-57. The script enforces the same checks used in continuous integration.

Are there exceptions to the stdlib-first rule?

Exceptions are granted only when a package is essential for I/O or performance reasons and cannot be reasonably implemented from scratch. Any exception request must include the justification: "stays stdlib-first for educational clarity" and receive maintainer approval via the repository's contribution checklist.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}