You can count dependencies added with AI help by combining two things: a commit marker that says AI assisted, and git history on your manifest files. List the commits that touched package.json or requirements, filter to the marked ones, and compare added package names. The count is only as good as your marking habit.
Start with what you can know
Git does not record who typed a line, a person or a model. It records commits, authors and messages. So any measurement rests on a convention your team follows. The common one is a trailer in the commit message, such as a Co-authored-by line naming the assistant. If your team does not mark commits, the number you get is a floor, not a count. The post on labeling AI assisted commits explains the convention.
Be honest about this in any report. A figure with a stated method is useful. A confident number from unmarked history is not.
The method in four steps
- Pick the manifest files. For most projects: package.json, requirements files, pyproject.toml, go.mod, pom.xml, Gemfile. Lockfiles change too, but manifests show intent.
- List commits that touched them. The git log documentation shows that you can restrict history to paths after a double dash separator. Add a date range and a format so the output is readable.
- Filter to the marked commits. Search the message for your trailer.
- Extract added names. Read the diff of each commit and note lines added in the dependency sections.
Example commands:
git log --since="2026-07-01" --format="%h %an %s" -- package.json requirements.txt
git log --since="2026-07-01" --grep="Co-authored-by" --format="%h %s" -- package.json
git log -G"\"left-pad\"" --format="%h %s" -- package.json
The log documentation describes the pickaxe options: with the -S option git finds commits that change the number of occurrences of a string, while -G finds commits whose diff has added or removed lines matching a regular expression. Use -G when you want to find where a particular package name was touched.
What to record per dependency
| Field | Why it helps |
|---|---|
| Package name and version | The basic fact |
| Commit and date | Lets you reconstruct the change |
| Marked as AI assisted | Your baseline split |
| Reviewer | Shows a person looked |
| Still used | Catches abandoned experiments |
How to read the result
Do not compare the raw count against a human only baseline and call one group worse. AI assisted work may touch more files, or it may be concentrated in prototypes. Compare like for like: the same repositories and the same periods.
More useful questions are practical ones. How many marked additions were reviewed by a named person? How many were removed within a month? How many were new to the organization, as opposed to already used elsewhere? The post on measuring AI coding impact without fooling yourself covers the broader traps.
Make the data easier next time
Add a line to your pull request template for dependency changes: package, reason, and whether an assistant suggested it. It costs little and gives you a field to query later. Keep the answer in the pull request body, which survives squash merges better than a commit trailer in some workflows.
Try it yourself
Open the dependency inventory demo to see a current component list with names and versions. That is the snapshot you compare against history.
Click through it at your own pace, or open it full screen.
Quick check
Can git tell me which lines an AI wrote?
No. Git records commits and authors. You need a marking convention such as a trailer or a pull request field, and you should state that limit when you report numbers.
Is the lockfile or the manifest better for counting?
Use the manifest to see intent and the lockfile to see everything that arrived, including transitive packages.
Safeguard's SBOM and dependency scanning gives you the current inventory to compare against. Run the free scan at gold.safeguard.sh/scan to see yours.
Sources
- Git documentation, git log: https://git-scm.com/docs/git-log
Last reviewed: 19 October 2026.
