How to use BrassCoders

`brasscoders scan`

Analyze your project. Writes .brass/*.yaml with the prioritized findings.

# From your project root:

$ brasscoders --offline scan

# Or scan a specific path:

$ brasscoders --offline scan /path/to/project

Useful flags:

--fast — skip privacy + content moderation passes
--dev — source code only (skip tests, build artifacts)
--code / --privacy / --content — narrow scope
--offline — guarantee zero outbound network calls (default behavior; flag is for explicitness)

`brasscoders filter`

Pipe an AI reviewer's JSON output through BrassCoders's noise-reduction. Returns the high-confidence findings.

# Pipe Claude / Cursor's review JSON in:

$ cat review.json | brasscoders filter

# Or as files:

$ brasscoders filter --input review.json --output filtered.json

CRITICAL findings always pass the filter. Style-only Pylint codes (C0301 line-too-long, etc.) are dropped. Per-file caps prevent any single file from dominating output.

Run it on every commit

BrassCoders is a command you invoke — there's no background daemon and no auto-run. Scanning on every commit is a setup step, and there are two places to wire it in:

CI on push — a GitHub Actions or GitLab CI step runs brasscoders --offline scan on every push. Enforced on the server, so no developer can skip it.
Pre-commit hook — the same command runs on the developer's machine before the commit is created, so bad code never enters git history.

Either way, with the --fail-on-critical flag BrassCoders exits non-zero (code 2) on critical/high findings — that is what fails the build or blocks the commit. Full setup for both mechanisms: Running BrassCoders on Every Commit.

Reading the output

After a scan, .brass/ contains:

File	Purpose
`ai_instructions.yaml`	Top-level summary; this is what you hand to Claude Code / Cursor
`detailed_analysis.yaml`	Every finding, grouped by type
`file_intelligence.yaml`	Per-file priorities
`security_report.yaml`	Security-only view
`statistics.yaml`	Aggregate metrics
`privacy_analysis.yaml`	Privacy-only view (only if PII findings exist)

Directory perms are 0700; YAML files are 0600 (POSIX). BrassCoders scans private source code, so the output is locked down.

Hand off to Claude Code (or Cursor / Continue / etc.)

Tell your AI assistant where the output lives — it can read the file itself. No copy-pasting required. .brass/ai_instructions.yaml is kept short on purpose so it fits comfortably in any context window.

A typical hand-off prompt:

"Read .brass/ai_instructions.yaml in this project. Address the critical_issues in order. For each one, propose a diff and explain the fix."

Claude Code, Cursor, and Continue all have filesystem access — they'll open the YAML, parse it, and work through the findings directly.