Can I Run BrassCoders Offline? Yes — Here's How
BrassCoders's OSS core makes zero outbound calls by default. The --offline flag adds hard enforcement for air-gapped CI, HIPAA, and SOC 2 environments.
The OSS Core Is Offline by Default
BrassCoders’s OSS core makes zero outbound network calls by default — every scanner runs locally against your source tree, and the output lands in .brass/ on your machine.
Every scanner BrassCoders runs — Bandit, Pylint, Pyre/Pysa, Semgrep, ast-grep, detect-secrets, and the six custom detectors — runs locally. Nothing leaves the machine. The scan works on a laptop with Wi-Fi off, in an air-gapped CI runner, or behind a strict corporate firewall.
The only time BrassCoders makes a network call is when the BrassCoders Paid enrichment is active. Paid-plan enrichment sends already-redacted findings and a project signature (at most 7,500 characters of non-sensitive metadata — never raw source code) to the BrassCoders gateway for semantic deduplication. If you’re on the OSS core, there’s no network traffic to block.
The —offline Flag for Regulated Environments
The —offline flag goes further than the default: it hard-disables every outbound path — the version check, the package-existence lookup, and the Paid enrichment call — so the scan makes zero network calls, giving regulated environments an auditable zero-egress posture.
For HIPAA, SOC 2, or air-gapped CI runners, a promise of “no outbound calls by default” may not be enough — you want a single explicit switch that disables every network path, including the optional and Paid ones, so the scan stays local regardless of environment. That’s what —offline provides.
brasscoders --offline scan .The flag is position-sensitive — it goes before scan, not after. With —offline, the scan never reaches out to an external host: every optional and Paid network path is disabled, so there is nothing to leak. Your CI logs show zero outbound connections.
Bandit (https://github.com/PyCQA/bandit) and Pyre/Pysa (https://pyre-check.org/) — two of the upstream scanners BrassCoders bundles — are themselves statically run against your source tree with no network calls. —offline applies to BrassCoders’s own transport layer.
Install BrassCoders with pip install brasscoders and run brasscoders scan . from your project root. The OSS core is free and Apache 2.0 licensed. BrassCoders Paid adds semantic noise reduction for $12/dev/month.
Frequently Asked Questions
Is BrassCoders completely offline?
The OSS core is completely offline — zero outbound calls by default. BrassCoders Paid requires a network connection for enrichment: it sends already-redacted findings and a project signature (at most 7,500 characters, never raw source code) to the BrassCoders gateway. If you're on the OSS core, no data ever leaves your machine.
What does the --offline flag do?
The --offline flag is a hard offline switch: it disables every optional outbound path (the version check, the package-existence lookup) and the Paid enrichment call, so the scan makes zero network calls and nothing leaves the machine. The default OSS core already makes no calls; --offline turns that into an explicit, single-flag guarantee — the auditable zero-egress posture for air-gapped environments or compliance requirements like HIPAA and SOC 2.
Does BrassCoders work in an air-gapped CI runner?
Yes — the OSS core runs with zero outbound calls. Install brasscoders and its dependencies before the runner goes air-gapped (or pre-bake a Docker image with brasscoders installed), then run brasscoders --offline scan . in the CI step. The --offline flag disables every outbound path, so the scan stays fully local even if a license key or update check is present in the environment.
Can I use BrassCoders Paid offline?
No — the Paid plan requires network access to reach the enrichment gateway. If your environment prohibits outbound calls, use the OSS core with --offline. The detection is identical at both tiers; only the semantic noise-reduction pass requires the gateway.