Yes — BrassCoders Works With Any Python Layout
BrassCoders scans Python source files at the file and AST level; it does not depend on how the project is packaged, so pyproject.toml (PEP 517), setup.py, and setup.cfg projects all scan identically.
The 12 scanners BrassCoders runs — Bandit, Pylint, Pyre/Pysa, Semgrep, ast-grep, detect-secrets, and the six custom detectors — operate on Python source files (.py) and TypeScript/JavaScript files (.ts, .js, .tsx, .jsx). They have no dependency on the project's build system.
Whether your project uses pyproject.toml (PEP 517, https://peps.python.org/pep-0517/), a traditional setup.py, or no manifest at all, the scan works the same way. The scanners read files from the directory tree you point at, not from any packaging metadata.
No configuration is required. pip install brasscoders && brasscoders scan . works from any Python project root.
How BrassCoders Uses pyproject.toml for Paid Enrichment
BrassCoders Paid reads pyproject.toml as the project manifest when building the project signature — a ≤7,500-character non-sensitive summary of your project sent to the enrichment gateway for semantic deduplication.
The project signature includes: your README excerpt, pyproject.toml (first 2,000 chars), your top-level filenames, and your main entrypoint. This is what makes Paid-plan deduplication project-aware — the enrichment knows you're a FastAPI app vs a Django app because it sees your dependencies and structure, not your source code.
pyproject.toml is an ideal manifest input because it contains your project name, Python version requirements, and dependencies in a structured format. Projects using setup.py or setup.cfg fall back to those files; pip documents the full resolution order (https://pip.pypa.io/en/stable/reference/build-system/pyproject-toml/).
If pyproject.toml is absent, the signature still builds from what's available. The enrichment degrades gracefully — it's an input, not a requirement.
Install BrassCoders with pip install brasscoders and run brasscoders scan . from your project root. The OSS core is free and Apache 2.0 licensed. BrassCoders Paid adds semantic noise reduction for $12/dev/month.
Top comments (0)