karpathy-minimalism

Skill 4: Minimalism & Agent-Native Design

Source: https://x.com/karpathy/status/2036487306585268612 | https://x.com/karpathy/status/2021694437152157847 litellm supply chain attack (~28k likes) | 243-line pure Python GPT (~25k likes)

Core Principle

Every dependency is a liability. Every abstraction you don't understand is a risk.

Karpathy's rule: if you can implement the core in 200 lines of pure Python — do it. Don't install a package that installs 47 transitive dependencies just to get 3 functions.

And: design everything so an LLM agent can use it without friction — CLI-first, markdown-structured, zero magic.

The Minimalism Decision Tree

Before pip install or npm install anything:

Q1: Can I implement the core function in < 300 lines?
    → YES: Write it. Paste below as reference.
    → NO: Continue to Q2

Q2: Does this package have < 5 transitive dependencies?
    → YES: OK to use, but pin the version
    → NO: Continue to Q3

Q3: Is this a well-known, audited package (requests, numpy, etc.)?
    → YES: Use it, but still pin version
    → NO: STOP. Either find a simpler alternative or implement yourself.

Dependency Audit Prompt

Run this before adding anything to a project:

Audit this dependency for supply chain risk:

Package: [PACKAGE_NAME] v[VERSION]

1. List ALL transitive dependencies (not just direct)
2. Check for recent security advisories
3. Identify any dependencies that are maintained by a single person with < 100 GitHub stars
4. Check if the package does any network calls on import
5. Check if install scripts run arbitrary code (setup.py, postinstall hooks)

Risk score: LOW / MEDIUM / HIGH
Recommendation: USE / AVOID / IMPLEMENT_YOURSELF

The "Yoink" Pattern (Karpathy's term)

Instead of installing a package, copy the specific function you need:

Given this package: [PACKAGE_URL or PASTE CODE]

Extract ONLY the function(s) I need for: [SPECIFIC_USE_CASE]

Requirements:
- Pure Python (stdlib only, no imports except builtins + [ALLOWED_STDLIB])
- Under [N] lines
- Add a comment: "# yoinked from [source] on [date]"
- Include a docstring explaining what it does

I need: [SPECIFIC_FUNCTION_NAME or DESCRIPTION]

Agent-Native Design Principles

Make everything legible to LLM agents:

❌ Agent-Hostile	✅ Agent-Native
GUI-only tools	CLI with clear flags
JSON config with magic keys	Commented YAML or Markdown config
Monolithic functions	Small, named, single-purpose functions
Error: "something went wrong"	Error: "Step 3 failed: expected X, got Y. Try: [suggestion]"
Relative paths everywhere	Explicit absolute paths
Stateful side effects	Pure functions with explicit IO

Minimal Implementation Template

When "yoinking" or implementing from scratch:

#!/usr/bin/env python3
"""
[FUNCTION_NAME] — minimal implementation
yoinked/inspired from: [SOURCE]
date: [DATE]
dependencies: none (stdlib only)

Usage:
    python3 [filename].py [args]
    
Or import:
    from [filename] import [function]
"""

# ---- core implementation ---- (~100 lines max for core logic)

def [function](input):
    """
    [One sentence description]
    
    Args:
        input: [type and description]
    Returns:
        [type and description]
    """
    # implementation
    pass


# ---- CLI entry point ----
if __name__ == "__main__":
    import sys
    if len(sys.argv) < 2:
        print("Usage: python3 [filename].py [input]")
        sys.exit(1)
    result = [function](sys.argv[1])
    print(result)

The 243-Line GPT Lesson

Karpathy implemented a full GPT training + inference in 243 lines of pure Python to prove a point: understanding the core matters more than using the abstracted version.

Apply this to any tool you regularly use:

Implement a minimal version of [TOOL/CONCEPT] from scratch.

Requirements:
- Pure Python, stdlib only
- Under 300 lines
- Must demonstrate the core algorithm (not just wrap an API)
- Include inline comments explaining WHY each step works

This is for learning, not production.
Start with the simplest possible working version.

Security Hygiene Checklist

Before adding any dependency:
- [ ] Checked PyPI/npm for recent security advisories
- [ ] Verified maintainer is active (last commit < 6 months)
- [ ] Reviewed install scripts (setup.py, package.json scripts)
- [ ] Pinned exact version: package==1.2.3 (not ~=1.2)
- [ ] Checked transitive dep count (pip show --files or npm ls --all)
- [ ] Considered: can we implement this in < 200 lines instead?

For existing projects:
- [ ] Run: pip-audit or npm audit
- [ ] Check for packages not in requirements.txt (pip freeze vs requirements diff)
- [ ] Verify no packages make network calls on import

Workflow

Belongs to workflow: Idea to Launch (Step 3)

Position	Upstream	Downstream
Step 3 (Slimming down)	karpathy-agentic-engineering (after implementation)	karpathy-supply-chain-hygiene (security review)

Full chain: idea-files → agentic-engineering → minimalism → supply-chain-hygiene → vibe-to-agentic

Prompt Contract

Audit this project/code for dependency minimalism: <PASTE_CODE_OR_DESCRIBE>. For each dependency: 1) Is it needed? What specific feature does it provide? 2) Can it be replaced with < 200 lines of stdlib code? 3) How many transitive deps does it pull in? 4) Risk score (LOW/MED/HIGH). Then produce a minimized version plan: what to keep, what to yoink, what to rewrite. Output a dependency budget: max N packages, each justified.

Verification Checklist

• Every dependency has a reason to exist (not "convenience")
• Those implementable in < 200 lines are marked as "yoinkable"
• Total transitive dependencies are within budget
• Core logic does not depend on any package that might be removed
• The agent can run core functionality in a stdlib-only environment
• The CLI entry point is simple and clear (usable without extra tools)