The AI development stack, mapped

Config left behind by AI coding tools, which measures how software is being built rather than what it ships.

Runtimes whose whole purpose is building agents, so a single dependency is enough to classify a repo.

Chain, retrieval and workflow layers that support agents without being agent runtimes themselves.

Repos touching the Model Context Protocol in any role. The SDK builds servers and clients alike and .mcp.json is a client config listing the servers an agent connects to, so this is a count of MCP adoption and not a count of MCP servers: 42% of it is classified as something other than a server.

Tools that record what an AI system actually did in production: every model call, the prompt, the reply, the tokens and the cost, nested into a replayable trace. Runtime only.

Tools that score model output against test cases, usually before shipping rather than in production. Separate from Tracing because passing a test suite says nothing about whether the running system is observable.

Tools that attack or scan an AI system to find its weaknesses, as opposed to the runtime filters in Guardrails that try to stop an attack while it happens. Kept separate because conflating them would let offensive testing inflate a claim about defensive coverage.

Repos reaching a model whose safety behaviour has been deliberately removed, served over an API so nothing appears in a dependency manifest. Counts are floors: only files the content pass fetches are searched.

PII redaction, prompt-injection filtering and policy enforcement. The smallest category here by a wide margin, which is itself the finding.

Runtimes that contain what an agent process can do: filesystem, network, process and credential scope, enforced outside the model. Separate from Guardrails because containment and content filtering are different controls, and conflating them would let sandbox adoption inflate a claim about filtering coverage. Counts are floors: the control plane is often a hosted service reached by API key, and OpenShell also ships a curl-installed CLI and Go and Rust SDKs that no npm or pypi manifest records.

Vector stores and agent memory. A vector store alone is not an AI signal, so these are corroborating rather than classifying: some carry no LLM client at all.

Repos calling a model vendor's own API directly, which is the baseline every other layer is measured against.

Repos putting one interface in front of several providers; adoption here is the clearest signal of a team refusing to be locked to one model, though router use inside a wider platform is not separable from ordinary calls.

Third-party endpoints serving open models, still undercounted after reseeding because most are OpenAI-compatible and reached through the openai package with a changed base URL that no manifest records.

Platforms for running your own model rather than calling someone else's.

Raw compute marketplaces, and a near-empty line even after we went looking properly: seeding these packages' dependents moved it from 18 repos to 104, which is still almost nothing, because renting a machine happens through a dashboard or SSH that no manifest records.

Fields re-read for every repo on every wave. The changing ones are the time series.

Gone and renamed repos, recorded as first-class events instead of silently dropped. The strongest irrecoverable category.

Raw manifests stored per wave. Every dependency claim is recomputed from these.

The SECURITY.md and lockfile evidence behind the published security claims.

Containerisation and CI, as a proxy for whether a repo is a real project.

Whether a repo publishes for machine readers.

Negative indicators. Always an explicit exclusion_reason, never a silent penalty.

Turning a repo into an organization, and the limits on doing so.