Does BrassCoders Work With pyproject.toml?
Yes — BrassCoders scans any Python project layout. It reads pyproject.toml as the project manifest for Paid-plan enrichment and works with both pyproject.toml and setup.py projects.
Yes — BrassCoders Works With Any Python Layout
BrassCoders scans Python source files at the file and AST level; it does not depend on how the project is packaged, so pyproject.toml (PEP 517), setup.py, and setup.cfg projects all scan identically.
Every scanner BrassCoders runs — Bandit, Pylint, Pyre/Pysa, Semgrep, ast-grep, detect-secrets, and the six custom detectors — operates on Python source files (.py) and TypeScript/JavaScript files (.ts, .js, .tsx, .jsx). They have no dependency on the project’s build system.
Whether your project uses pyproject.toml (PEP 517, https://peps.python.org/pep-0517/), a traditional setup.py, or no manifest at all, the scan works the same way. The scanners read files from the directory tree you point at, not from any packaging metadata.
No configuration is required. pip install brasscoders && brasscoders scan . works from any Python project root.
How BrassCoders Uses pyproject.toml for Paid Enrichment
BrassCoders Paid reads pyproject.toml as the project manifest when building the project signature — a ≤7,500-character non-sensitive summary of your project sent to the enrichment gateway for semantic deduplication.
The project signature includes: your README excerpt, pyproject.toml (first 2,000 chars), your top-level filenames, and your main entrypoint. This is what makes Paid-plan deduplication project-aware — the enrichment knows you’re a FastAPI app vs a Django app because it sees your dependencies and structure, not your source code.
pyproject.toml is an ideal manifest input because it contains your project name, Python version requirements, and dependencies in a structured format. Projects using setup.py or setup.cfg fall back to those files; pip documents the full resolution order (https://pip.pypa.io/en/stable/reference/build-system/pyproject-toml/).
If pyproject.toml is absent, the signature still builds from what’s available. The enrichment degrades gracefully — it’s an input, not a requirement.
Install BrassCoders with pip install brasscoders and run brasscoders scan . from your project root. The OSS core is free and Apache 2.0 licensed. BrassCoders Paid adds semantic noise reduction for $12/dev/month.
Frequently Asked Questions
Does BrassCoders scan pyproject.toml for security issues?
BrassCoders scans Python source files (.py) and JavaScript/TypeScript files. pyproject.toml itself is not scanned for security issues, but it is read by the Paid-plan enrichment as the project manifest — the first 2,000 characters go into the project signature used for semantic deduplication.
Does BrassCoders work with Poetry or Hatch projects?
Yes — Poetry and Hatch both use pyproject.toml as the project manifest. BrassCoders scans the Python source files regardless of which tool manages the project. If you're on BrassCoders Paid, pyproject.toml is read as the manifest for the project signature, which works identically for Poetry and Hatch projects.
What if my project has no pyproject.toml?
The scan runs fine — BrassCoders scans Python source files regardless of whether a manifest exists. If you're on the Paid plan, the project signature falls back to setup.py or setup.cfg if present, or builds from README and top-level filenames alone if no manifest is found.
Does BrassCoders lint pyproject.toml configuration?
No — BrassCoders does not audit your build system configuration. It scans Python source files for security, performance, and correctness bugs. If you want to lint pyproject.toml configuration, tools like validate-pyproject cover that layer.