BrassCoders OSS Core vs Paid: When to Upgrade

Most tool vendors want you on the paid plan as fast as possible. Here’s the answer BrassCoders gives instead: start free, and upgrade only when you can name the reason. The OSS core finds every bug the paid plan finds. What you pay for is ranking, and ranking is only worth money once you have too many findings to read.

The Same Detection, a Different Output

BrassCoders runs the identical 12 scanners on a free install and a paid install, and they find the identical set of bugs. Nothing is gated behind the license. The split is entirely in what comes out: the free core’s heuristic deduplication narrows the raw pile, and the Paid enrichment ranks it further. In one published case study, that took a scan from 2,470 raw findings to 217 after heuristic reduction to 22 after enrichment — real ratios vary by codebase size.

So the decision isn’t about coverage. You are not trading away detection by staying free, and you are not buying extra detection by paying. The detail of how the Paid pass ranks and deduplicates is in what the enrichment actually does; this post is about which side of the line you’re on.

When the Free Core Is Enough

BrassCoders’s OSS core is the whole product for a large share of teams, and it’s free forever under Apache 2.0. If your scan’s deduplicated output — in one published case study, heuristic reduction alone got a scan to 217 findings — is something you and your AI assistant triage without strain, you’ve already got what you need. Paste the YAML into Claude Code or Cursor, work the list, ship.

A few situations point firmly at staying free: small and mid-size repos where the raw count is low to begin with, occasional rather than daily scanning, and solo or early-stage projects. Regulated and air-gapped environments belong here too — the OSS core makes zero outbound network calls by default, and --offline enforces it, so the free path is also the compliant one.

When Paid Earns Its $12

BrassCoders Paid earns its keep when your scan’s post-heuristic output is more than anyone will actually read every time — in one published case study, Paid ranked 217 findings down to 22 — and that ranking buys back more than $12 a month of attention. That’s the threshold: whether the volume is costing you triage time, not repo size in the abstract.

In practice that means a large codebase scanned daily through active feature work, where each scan otherwise dumps a few hundred findings a developer has to re-sort by hand. The arithmetic is unsentimental: if the relevance ranking saves a developer fifteen minutes a week, it has covered its cost several times over. If it doesn’t save you that, don’t pay for it.

The Honest Default: Start Free

BrassCoders treats the OSS core as enough for most users, and says so. The Paid plan is a way to support the project by getting real value from it, and the free tier isn’t crippled to push the upgrade. The right path for almost everyone is to install the OSS core, run it for a while, watch the output volume, and upgrade only when the noise becomes the bottleneck.

The switch is low-commitment in both directions. One license covers 3 machine activations, you can deactivate a machine to free a slot, and cancellation ends at the billing period with no pro-rate math to argue about. You’re never locked in, and the OSS core keeps scanning whether or not a license is active.

Try Both

Start with the free core; add the license only when the volume tells you to.

pipx install brasscoders
brasscoders --offline scan          # free: all 12 scanners, heuristic dedup applied
brasscoders activate <license-key>  # Paid: ranks further via AI enrichment

The full pricing detail is on the pricing page, and the map of everything the scanners find — the part that’s free either way — is in what BrassCoders detects.