Can I Run BrassCoders Offline? Yes — Here's How
BrassCoders's OSS core makes zero outbound calls by default. The --offline flag adds hard enforcement for air-gapped CI, HIPAA, and SOC 2 environments.
The OSS Core Is Offline by Default
BrassCoders’s OSS core makes zero outbound network calls by default — every scanner runs locally against your source tree, and the output lands in .brass/ on your machine.
Every scanner BrassCoders runs — Bandit, Pylint, Pyre/Pysa, Semgrep, ast-grep, detect-secrets, and the six custom detectors — runs locally. Nothing leaves the machine. The scan works on a laptop with Wi-Fi off, in an air-gapped CI runner, or behind a strict corporate firewall.
The only time BrassCoders makes a network call is when the BrassCoders Paid enrichment is active. Paid-plan enrichment sends already-redacted findings and a project signature (at most 7,500 characters of non-sensitive metadata — never raw source code) to the BrassCoders gateway for semantic deduplication. If you’re on the OSS core, there’s no network traffic to block.
The —offline Flag for Regulated Environments
The —offline flag goes further than the default: BrassCoders adds a hard check at runtime and exits with a non-zero status code if any network call is attempted, giving regulated environments an auditable guarantee.
For HIPAA, SOC 2, or air-gapped CI runners, a promise of “no outbound calls by default” may not be enough — you need a guarantee that the scan cannot make a call even if something changes. That’s what —offline provides.
brasscoders --offline scan .The flag is position-sensitive — it goes before scan, not after. With —offline, any attempt to reach an external host causes an immediate non-zero exit. Your CI job fails loudly rather than silently succeeding while leaking data.
Bandit (https://github.com/PyCQA/bandit) and Pyre/Pysa (https://pyre-check.org/) — two of the upstream scanners BrassCoders bundles — are themselves statically run against your source tree with no network calls. —offline applies to BrassCoders’s own transport layer.
Install BrassCoders with pip install brasscoders and run brasscoders scan . from your project root. The OSS core is free and Apache 2.0 licensed. BrassCoders Paid adds semantic noise reduction for $12/dev/month.
Frequently Asked Questions
Is BrassCoders completely offline?
The OSS core is completely offline — zero outbound calls by default. BrassCoders Paid requires a network connection for enrichment: it sends already-redacted findings and a project signature (at most 7,500 characters, never raw source code) to the BrassCoders gateway. If you're on the OSS core, no data ever leaves your machine.
What does the --offline flag do?
The --offline flag adds a hard enforcement layer: BrassCoders exits non-zero if any network call is attempted at runtime. The default behavior (OSS core) makes no calls and doesn't enforce this at the process level. --offline is the auditable guarantee for air-gapped environments or compliance requirements like HIPAA and SOC 2.
Does BrassCoders work in an air-gapped CI runner?
Yes — the OSS core runs with zero outbound calls. Install brasscoders and its dependencies before the runner goes air-gapped (or pre-bake a Docker image with brasscoders installed), then run brasscoders --offline scan . in the CI step. The --offline flag ensures the scan fails loudly if anything attempts a network call.
Can I use BrassCoders Paid offline?
No — the Paid plan requires network access to reach the enrichment gateway. If your environment prohibits outbound calls, use the OSS core with --offline. The detection is identical at both tiers; only the semantic noise-reduction pass requires the gateway.