The AI SDK market, by downloads

Every app that calls a model starts with one line in a package file: openai, @anthropic-ai/sdk, ai, langchain-core. Which line it is says something about who developers build on, and the registries publish how often each package is fetched. The usual reading of those counts is a scoreboard: Anthropic is winning, OpenAI is winning, LangChain is dead, LangChain is everywhere. Most of those readings come from a single chart on a stats site, for one registry, without asking what else pulls the package in.

We pulled daily download counts from npm and PyPI for about 50 AI packages in each registry, from January 2023 to the end of October 2026, and compared the same window, 1–29 October, in every year. Then we removed what we could of the noise: downloads that are really dependencies of other packages, CI runs, mirrors, and a change PyPI made to its own counting on 24 August 2026 that cut a third of all its download counts overnight. Downloads are not users, installs or apps. They are still the best public trace of what code is being built, as long as you read them with their plumbing.

Anthropic passed OpenAI on npm#

For most of the last three years the two SDKs were not close on npm. In January 2024 openai was downloaded 6.2M times and @anthropic-ai/sdk 1.3M. Both grew, but Anthropic's growth turned steep in spring 2026: from 24.1M in February to 85.4M in May. Its first seven-day lead came on 31 May 2026. From 24 September it has led every day.

Anthropic's SDK went from 0.26 downloads per OpenAI download in October 2024 to 0.35 in October 2025, 0.81 in April 2026 and 1.10 in October 2026. Google's two JavaScript SDKs together are at 0.65 of OpenAI's.

Code that depends on each SDK is a different picture. GitHub counts about 425,639 public repositories that depend on npm openai and 81,294 that depend on @anthropic-ai/sdk, 5.2× as many; GitHub itself calls these counts approximate. Downloads track how often code is built and run, and Anthropic's SDK is now built and run more often, but OpenAI's is in more public repositories.

Who pulls whom#

A package is downloaded every time anything installs it, including another package that lists it as a dependency. On npm, the Claude Agent SDK declares @anthropic-ai/sdk as a peer dependency, which npm installs automatically: every Claude Agent SDK install is also an Anthropic SDK download. LangChain's @langchain/anthropic and @langchain/openai do the same for each vendor, and @openai/agents requires openai.

We subtracted the October downloads of those packages from each SDK. If two of them sit in the same install, the SDK is fetched once, so this over-corrects, and what's left is a floor.

What's left for Anthropic is still large: at least 124M downloads a month that neither the Agent SDK nor LangChain explains, and nobody publishes the rest of the attribution. Two things we checked don't inflate it: the Claude Code CLI bundles its dependencies, and the Vercel AI SDK's Anthropic adapter calls the API over HTTP without the SDK. A plausible source is CI: Anthropic's official GitHub Action for Claude Code installs the Agent SDK, and so the Anthropic SDK, but we can't measure how much.

The most downloaded package in the whole set isn't an SDK for any model. The Model Context Protocol's TypeScript SDK, @modelcontextprotocol/sdk, had 245.8M npm downloads in October, more than any provider SDK, and the Python mcp package had 275.0M, more than anthropic. Most of that is dependency traffic too: the Claude Agent SDK, Mistral's JavaScript SDK, the OpenAI Agents SDK for Python, CrewAI and Strands all pull it in. We covered the protocol itself in the state of MCP.

Across both registries, October's totals were 496M downloads for OpenAI's SDKs, 358M for Anthropic's and 265M for Google's (old and new SDKs added together). Downloads also aren't spend: Menlo Ventures, an investor in Anthropic, estimated from a survey of 495 US enterprise buyers that Anthropic took 40% of enterprise LLM spend in 2025 and OpenAI 27%.

Python is still OpenAI's#

On PyPI the gap is wide. In 1–29 October 2026 openai was downloaded 336.7M times, anthropic 181.4M and google-genai 151.8M. Anthropic gets 0.54 downloads for every OpenAI one.

PyPI's numbers need care before 24 August 2026, when PyPI changed what it counts (more below). From January 2026 we can remove the old metadata requests row by row, which gives a like-for-like series for this year. On it, Anthropic gained on OpenAI every month.

The CI share is the biggest difference between the two. PyPI's logs record whether the installer reported a CI environment, and 59.2% of Anthropic's October downloads did, against 40.5% of OpenAI's. In February the two were 42.3% and 32.7%. Several agent SDKs (Pydantic AI, the Claude Agent SDK, OpenAI's Agents SDK, LangGraph) are among the most CI-heavy packages we measured; LangChain's core package is one of the least.

Developer machines tell the same story. In September 2026, PyPI downloads from macOS and Windows, which are laptops and desktops rather than servers, were 10.29M for openai and 3.84M for anthropic: 0.37 to one, the same as the non-CI ratio. GitHub's dependents count for Python is wider still: about 525,860 public repositories depend on openai and 66,058 on anthropic, 8.0×.

The framework layer moved to the Vercel AI SDK#

In JavaScript, the package most AI apps import isn't a vendor's. Vercel's AI SDK, published as ai, passed LangChain.js (@langchain/core) on a rolling seven-day basis on 3 May 2025 and has led since. In October 2026 it had 115.4M downloads, 4.9× LangChain.js, ×7.3 a year earlier and ×66 two years earlier.

Vercel's own claims line up with the registry. It said the AI SDK had "over 16 million weekly downloads" when version 7 shipped in June 2026; ai alone had 66.2M that month, about 15.5M a week.

The AI SDK talks to models through small adapter packages, one per provider, and those are a cleaner read of which model a JavaScript developer picks than the vendor SDKs, because far fewer packages pull them in. In October 2026 OpenAI's and Anthropic's adapters were level.

The long tail is the point of an abstraction layer. "OpenAI-compatible", the adapter for any endpoint that speaks OpenAI's API (local models, gateways, smaller labs), is the fourth-largest at 11.8%.

LangChain is growing and shrinking at once#

"Is LangChain dead?" gets two true answers. In absolute terms it has never been bigger: langchain-core, the package every LangChain integration depends on, had 150.1M PyPI downloads in October 2026, at least 2.2× a year earlier (PyPI's year-on-year growth is understated, see below), and @langchain/core had 23.4M on npm, ×3.2. LangGraph, LangChain's agent framework, had 53.1M on PyPI. As a share of the framework layer, it has fallen steadily.

In Python LangChain is still the biggest framework by almost three times the next one, and that one is LangChain's own LangGraph.

The developer surveys agree that LangChain is still the most used and that it has company. In Stack Overflow's 2026 survey, 30.2% of the 4,400 respondents who answered the question had used LangChain for agent orchestration in the past year, ahead of the OpenAI Agents SDK at 23.8%. A year earlier LangChain was at 32.9%, but the 2025 list offered different tools, so only a few names compare across years. We wrote about what's left of Stack Overflow itself in a separate post.

The vendors' own agent SDKs#

Some of the fastest-growing packages in both registries are the agent SDKs the model makers ship themselves. The Claude Agent SDK, renamed from the Claude Code SDK in September 2025, had 46.4M npm downloads in October 2026, ×53 a year earlier, and 33.3M on PyPI across both names, at least ×34 a year earlier. OpenAI's Agents SDK, launched in March 2025 and pitched as an improvement on OpenAI's experimental Swarm, had 7.5M downloads on npm (×15.5) and 15.3M on PyPI.

These SDKs change what lock-in means. A provider SDK is a thin client for one HTTP API; switching from one to another is an afternoon. An agent SDK brings its own loop, tool format and session model, and each one requires its vendor's client: every Claude Agent SDK install fetches the Anthropic SDK, every OpenAI Agents SDK install fetches OpenAI's. The provider-agnostic layer and the vendor-specific one are both growing, and they're growing in different places.

Python and JavaScript are converging#

Python has always been the bigger registry for AI code, and still is: PyPI's provider-SDK downloads were 738.1M in October against npm's 474.4M. But npm's share of those downloads rose from 16% in October 2025 to 39% in October 2026. The 2025 figure is held down by the PyPI metadata counting we explain below; corrected for it, the start was nearer 24%, so the rise is from about a quarter to two-fifths.

That's the shape behind the headline race. Anthropic leads where JavaScript is growing fastest, and OpenAI leads where most of the existing Python code already is.

Churn: six majors and a 0.x that lasted three and a half years#

Picking an SDK also means picking its release schedule. Vercel's ai shipped its first version as 2.0 in June 2023 (the name's earlier versions belonged to a different 2014 package) and reached 7.0 in June 2026: six majors in 36 months, one about every seven months, with the provider adapters moving in lockstep. It published 935 versions in the last year. Anthropic's Python SDK did the opposite: it stayed on 0.x from February 2023 to 1.0.0 on 20 August 2026, then shipped 2.0.0 two months later.

Deprecations linger. Google's old JavaScript Gemini SDK reached end of support on 30 November 2025, and its repository has since been archived, yet GitHub still counts about 148,781 public repositories that depend on it, 3.5× as many as on its replacement. Eleven months later, @google/generative-ai was still downloaded 14.6M times in October.

Why download counts lie#

The biggest single event in this dataset isn't a product launch. On 24 August 2026 PyPI changed its logging so that, in its words, "a request has to end in .whl, .tar.gz, or .zip to produce a download record". Before that, requests for a package's metadata file counted as downloads. Modern Python installers fetch metadata for many old versions while they resolve dependencies, so the inflation was uneven: worst for packages with long, tangled dependency trees.

That has two consequences for anything you read about Python AI packages. Spring and summer 2026 "booms" were mostly metadata: raw LiteLLM went from 97.6M in March to 682.8M in July, while its real artifact downloads went from 29.7M to 99.2M. And any year-on-year PyPI growth compares a clean 2026 with an inflated 2025, so it understates growth: write "at least".

Vendor claims made before the change are on the old basis too. LangChain said in October 2025 that langchain and langgraph had "a combined 90M monthly downloads", which matches PyPI's counts at the time. The MCP maintainers' "close to half-a-billion downloads a month" in July 2026 matches too, but with metadata removed that month is about 350M.

The rest of the plumbing is quieter but always there. CI reruns, Docker rebuilds and agent sandboxes all download packages; a package can be pulled in by something the developer never chose; every new release gets fetched by mirrors and security scanners. PyPI's own post says download counts "should not be used as a proxy for criticality or popularity". They're a measure of how much code is being built, and that's what we've used them for.

What this means if you build with AI#

1. Put a provider-agnostic layer between your app and the model when you can. In JavaScript that is now the Vercel AI SDK by a wide margin, and its provider-adapter downloads split almost evenly between OpenAI and Anthropic. Switching models becomes a different adapter and a model id, which matters when the leading model changes every few months. Reach for a vendor SDK directly when you need a feature the layer doesn't expose yet.
2. Treat an agent SDK as the real lock-in. The Claude Agent SDK and the OpenAI Agents SDK are among the fastest-growing packages here, and each requires its vendor's client. They save a lot of work. Choose one knowing that its loop, tool format and sessions don't move to the other vendor.
3. Budget for churn. ai had six majors in 36 months and 935 releases in the last year. Anthropic's Python SDK was 0.x for three and a half years, then went to 1.0 and 2.0 within two months. Pin exact versions, keep a lockfile, read the migration guide before a major, and let your agent do the upgrade in its own branch.
4. Check you're on the current package. Google's old Gemini SDKs ended support a year ago and are still downloaded millions of times a month. LlamaIndex's TypeScript package is deprecated; AutoGen is in maintenance. If an agent wrote your code from older examples, check the package names in the manifest.
5. Don't choose by download counts alone. A lead on one registry can be dependency structure, CI or a counting change. Look at both registries, at what pulls what, and at whether the project fits your language and stack. For Python, LangChain is still the most-downloaded framework and a safe default; in JavaScript, it no longer is.
6. If you publish a package, count your users another way. Downloads won't tell you who uses it. A survey, an opt-in ping or the GitHub dependents page tell you more, and they don't change when the registry changes its logs.

Whatever SDK your agent picks, the result is usually a page or a small app that someone else needs to open. host0 hosts what your agent makes at a link you can share, with a shared database when the app needs one.

Methodology#

• npm. Daily downloads per package from the npm downloads range API (api.npmjs.org/downloads/range), January 2023 to 29 October 2026, for 50 packages, summed by month. npm counts every successful tarball fetch, including CI and mirrors. A sample of 12 package-months matched npm's point API exactly.
• PyPI. Daily downloads per project from ClickHouse's public copy of the PyPI download logs (the same data as Google BigQuery's pypi.file_downloads), for 52 projects, with mirror installers removed. 32 of 32 sampled project-months matched pypistats.org within ±1.4%.
• The comparison window is 1–29 October in every year, for both registries, because npm's data ended on 29 October. Monthly charts stop at September 2026 unless they're ratios.
• PyPI's counting change. PyPI stopped counting metadata requests on 24 August 2026. The row-level logs record file names from 8 January 2026, so for 2026 we removed metadata requests by measuring their share per project and day ("like-for-like"). Earlier PyPI numbers can't be corrected; year-on-year PyPI growth is stated as "at least".
• CI is the installer-reported CI flag in PyPI's logs. It's a floor on automated traffic. npm has no equivalent.
• Dependency adjustment subtracts the October downloads of packages whose current release requires the SDK (named in each chart). It over-corrects when two of them share an install, so the result is a floor.
• Definitions. Provider SDKs are the vendors' API clients; Google is its old and new SDK added together. Frameworks are agent and app frameworks, measured by their core package (LangChain by langchain-core / @langchain/core). LiteLLM is a gateway and isn't counted as a framework.
• Context. Release dates come from the npm and PyPI registry metadata. GitHub dependents counts are GitHub's "Used by" numbers, which it calls approximate. Survey and vendor figures are cited with their source and re-read on 31 October 2026.

Downloads aren't users, installs or apps. The scripts, raw pulls and the full data pack are in our repository under docs/research/2026-10-31-ai-sdk-downloads.md.

Open questions#

• What else pulls the Anthropic SDK on npm? At least 124M October downloads aren't explained by the Agent SDK or LangChain. Neither npm nor GitHub publishes downloads by dependent.
• How much of the remaining PyPI volume is automated? Agent sandboxes and container builds that don't set a CI variable look like people in the logs.
• What did October 2025 really look like on PyPI? The file-level data starts in January 2026, so last year's metadata share can only be estimated.
• Will there be another break? PyPI says it wants to record partial-file requests separately (the work isn't scheduled yet), which could make a second discontinuity.