What BrassCoders Paid's Enrichment Actually Does

BrassCoders runs 12 scanners and emits the union of their findings — thousands, on a real codebase. Every one of those is found by the free OSS core. The problem a paid plan solves was never detection; it’s that a raw scan is more than anyone reads every time. In one published case study, BrassCoders Paid ranked a 2,470-finding scan down to 22 that mattered, for $12 per developer per month — real ratios vary by codebase size.

Detection Is Free; Ranking Is the Paid Part

BrassCoders finds every bug at the free level — all 12 scanners, no caps, Apache 2.0, zero outbound network calls. The Paid plan adds no detectors and keeps no rules behind the paywall; the scan that runs on a free install and a paid install finds the identical set of bugs.

What Paid adds is a ranking pass. There is one paid plan at one price, and what it changes is the shape of the output: from a long unordered list to a short ordered one. If your raw scan is already small enough to read, the OSS core is the whole product. If it isn’t, the ranking is what you’re buying.

The Funnel: Raw Findings to a Focused Shortlist

BrassCoders narrows a scan in two stages, and only the second one is paid. The OSS core runs a heuristic deduplication that collapses the obvious repeats a 12-scanner union produces when several engines flag the same line. In one published case study, that stage alone took a scan from 2,470 raw findings down to 217.

The Paid enrichment is the second stage. It runs a semantic deduplication and a relevance ranking on top of that, ordered by how much each finding matters to your specific project. In the same case study, the 217 collapsed to 22 after enrichment. The detection didn’t change between the raw scan and the final shortlist; the noise did. Real ratios vary by codebase size, but you read the shortlist instead of triaging the raw pile.

What Actually Gets Sent

BrassCoders Paid sends two things to its hosted gateway, and neither is your code. The first is the findings themselves, already redacted at the scanner — locations and types, with secret and PII values stripped before they ever leave the machine. The second is a project signature: up to 7,500 characters of non-sensitive metadata pulled from your README, your dependency manifest, and your top-level filenames.

That’s the whole payload. Raw source code never leaves the machine, on either plan. The redacted secret values never leave it. And the OSS-only path (a free install, or any scan without an active license) makes zero outbound calls at all. The enrichment runs through a hosted embedding model; BrassCoders passes its per-token cost straight through.

How the Ranking Works

The enrichment embeds your findings and your project signature into vectors, then ranks each finding by how semantically close it is to what your project actually is. A SQL injection in the core request path of a payments service ranks at the top; the same pattern in a vendored test fixture ranks far below it. The model isn’t deciding whether a finding is a true bug — that triage stays with your AI assistant — it’s deciding what’s worth your attention first.

The same embedding step powers the semantic deduplication. A 12-scanner union produces clusters of near-duplicate findings that a string match misses: three engines describing one taint flow in three vocabularies. The enrichment recognizes them as one finding and collapses the cluster — in the published case study above, that’s most of how 217 becomes 22.

What It Costs, and What It Doesn’t

BrassCoders Paid is $12 per developer per month and includes 50 million enrichment tokens — roughly 30-50 scans of a real codebase, which covers an active developer running scans through a feature’s worth of work. Topups bill at the upstream API cost with no markup. The pricing principle is straight pass-through: you pay what the embedding work costs, not a margin on it.

One bill stays yours. The YAML BrassCoders produces is meant to be read by your AI assistant — Claude Code, Cursor, Continue — and whatever you spend with Anthropic or OpenAI for that is your own account, not something BrassCoders resells. See pricing for the full breakdown.

Try It

The OSS core is the place to start; add Paid when the raw volume is the bottleneck.

pipx install brasscoders
brasscoders --offline scan          # free: all 12 scanners, heuristic dedup applied
brasscoders activate <license-key>  # then scans rank further via AI enrichment

For the detection side of the product — every scanner that produces those findings in the first place — see what BrassCoders detects.