What Does a BrassCoders Scan Output Look Like?
BrassCoders writes three YAML files to .brass/ — a ranked AI instructions file, a full findings file, and a security-only view. Here's what each contains.
Three Files in the .brass/ Directory
BrassCoders writes three YAML files to .brass/ after every scan: ai_instructions.yaml (short, severity-ranked findings for AI assistants), detailed_analysis.yaml (every finding with full context), and security_report.yaml (security-only view for audit purposes).
Run brasscoders scan . and a .brass/ directory appears at your project root. Three files:
- ai_instructions.yaml — the primary output. Short, severity-ranked findings designed for pasting into Claude Code or Cursor. Contains title, severity, confidence, file_path, line_number, scanner, and a one-sentence description. This is what your AI assistant reads.
- detailed_analysis.yaml — the full output. Every finding with extended context, evidence strings, and scanner metadata. Useful for deeper review or custom tooling.
- security_report.yaml — security findings only, separated for audit purposes. Useful if your security team wants a focused view without performance or PII findings.
What ai_instructions.yaml Contains
BrassCoders structures ai_instructions.yaml to be pasted directly into Claude Code or Cursor — each finding has a title, severity level (CRITICAL/HIGH/MEDIUM/LOW), confidence score, exact file path, line number, and a description written for an AI reviewer, not a human reader.
The YAML format (https://yaml.org/spec/1.2.2/) makes ai_instructions.yaml readable by any tool. The Paid plan adds an enrichment pass that reduces a typical 1,500+ finding scan to roughly 30 actionable entries — deduplicated against your project’s README, dependency manifest, and top-level structure.
The intended workflow: open Claude Code (https://docs.anthropic.com/en/docs/claude-code) or Cursor, paste the contents of ai_instructions.yaml into the context window, and ask the AI to triage the findings. The format is designed for that consumption pattern.
The .brass/ directory is safe to add to .gitignore — it’s generated output, not source. Re-run the scan whenever you want a fresh view.
Install BrassCoders with pip install brasscoders and run brasscoders scan . from your project root. The OSS core is free and Apache 2.0 licensed. BrassCoders Paid adds semantic noise reduction for $12/dev/month.
Frequently Asked Questions
What files does brasscoders scan create?
Three YAML files in .brass/ at your project root: ai_instructions.yaml (short, ranked findings for AI assistants), detailed_analysis.yaml (full findings with extended context), and security_report.yaml (security findings only, for audit purposes).
Can I parse .brass/ai_instructions.yaml programmatically?
Yes — it's standard YAML. Any YAML library (PyYAML, ruamel.yaml in Python; js-yaml in Node.js) can parse it. Each finding is a YAML mapping with keys: title, severity, confidence, file_path, line_number, scanner, description.
Should I commit .brass/ to version control?
No — .brass/ is generated output and regenerates on every scan. Add it to .gitignore. Committing it adds churn without value; the scan output is only meaningful at the moment it was generated against the current source tree.
How is the Paid plan output different from the OSS core output?
The structure is identical — three YAML files in .brass/. The difference is volume: the OSS core produces a few hundred entries after heuristic deduplication; the Paid plan adds semantic deduplication against your project signature and typically reduces that to roughly 30 actionable findings.