Can I Run BrassCoders Offline? Yes — Here's How

The OSS Core Is Offline by Default

BrassCoders's OSS core makes zero outbound network calls by default — all 12 scanners run locally against your source tree, and the output lands in .brass/ on your machine.

Every scanner BrassCoders runs — Bandit, Pylint, Pyre/Pysa, Semgrep, ast-grep, detect-secrets, and the six custom detectors — runs locally. Nothing leaves the machine. The scan works on a laptop with Wi-Fi off, in an air-gapped CI runner, or behind a strict corporate firewall.

The only time BrassCoders makes a network call is when the BrassCoders Paid enrichment is active. Paid-plan enrichment sends already-redacted findings and a project signature (at most 7,500 characters of non-sensitive metadata — never raw source code) to the BrassCoders gateway for semantic deduplication. If you're on the OSS core, there's no network traffic to block.

The --offline Flag for Regulated Environments

The --offline flag goes further than the default: BrassCoders adds a hard check at runtime and exits with a non-zero status code if any network call is attempted, giving regulated environments an auditable guarantee.

For HIPAA, SOC 2, or air-gapped CI runners, a promise of "no outbound calls by default" may not be enough — you need a guarantee that the scan cannot make a call even if something changes. That's what --offline provides.

brasscoders --offline scan .

The flag is position-sensitive — it goes before scan, not after. With --offline, any attempt to reach an external host causes an immediate non-zero exit. Your CI job fails loudly rather than silently succeeding while leaking data.

Bandit (https://github.com/PyCQA/bandit) and Pyre/Pysa (https://pyre-check.org/) — two of the upstream scanners BrassCoders bundles — are themselves statically run against your source tree with no network calls. --offline applies to BrassCoders's own transport layer.

Install BrassCoders with pip install brasscoders and run brasscoders scan . from your project root. The OSS core is free and Apache 2.0 licensed. BrassCoders Paid adds semantic noise reduction for $12/dev/month.