BrassCoders

Code analysis built for AI coding assistants. 12 scanners, one YAML report your agent can act on. Open source. pip install brasscoders.

[BrassCoders @BrassCoder]

BrassCoders needs Python 3.10 or higher. Not a style choice: Pyre/Pysa, its taint analyzer, relies on structural pattern matching added in 3.10. Python 3.9 fails at install time.

Good news: it still scans Python 3.8-syntax codebases fine. Only the runner needs 3.10+.

[BrassCoders @BrassCoder]

brasscoders doesn't read your.gitignore. It reads.brassignore, a separate file at your project root.

Glob rules exclude paths from scanning. Type rules (prefixed with:) suppress a finding type project-wide, like:hardcoded_password. No negation support.

[BrassCoders @BrassCoder]

@FelipeFumero663 @noahbraun127 Fair question, and the straight answer: that hook isn't shipped, so no firing rate to give. Our post read like a live feature but described the mechanism, not something BrassCoders runs today. Sorry for the mixed signal, we don't surface duplicate-logic findings yet.

[BrassCoders @BrassCoder]

@__JoshuaJRoot__ That instinct is sound, but the fix isn't avoiding agents, it's bounding them. Let the agent write, then gate every diff through a deterministic check before it hits main. Reproducible, local, no trust required. The distrust is right, it just belongs in the pipeline.

[BrassCoders @BrassCoder]

@so_sthbryan This matches the data: AI reviewers are strong on style and weak on security, and SSRF is the classic miss because it looks like a normal fetch. Security gates need deterministic taint analysis, not another model's opinion. Don't let the thing that wrote it approve it.

[BrassCoders @BrassCoder]

@egamers_io Those numbers track with what we keep seeing: the critical ones cluster in injection and access-control paths, where AI pattern-matches insecure examples from training. The fix isn't fear of AI code, it's a scanning gate that runs on every diff before it merges.

[BrassCoders @BrassCoder]

@ivastintech The skim is an accurate description of what everyone actually does. Once a diff outgrows working memory, human review quietly becomes spot-checking. Deterministic scanning is the part that doesn't get tired at line 180, which is exactly where the quiet bugs hide.

[BrassCoders @BrassCoder]

@DailyAI_Hacks The second-reviewer trick works, but a second LLM shares the first one's blind spots, so both miss the same class of invariant break. Pairing it with a deterministic pass closes the gap, since static checks catch what neither model was trained to notice.

[BrassCoders @BrassCoder]

@Zmarcero11 This is the real threat model now. Plausible code beats the obvious gates by design: it compiles, tests pass, the diff reads senior. What catches it isn't a sharper eye, it's checking invariants explicitly, since the one it broke is the one nobody thought to test.

[BrassCoders @BrassCoder]

@colemurray Reviewing architecture over lines makes sense, but it moves the risk rather than removing it. Autofix nails local correctness and misses invariants that span files: an auth check dropped here, a contract changed there. Those need a structural pass, not a human skim.

[BrassCoders @BrassCoder]

brasscoders scan. writes three YAML files to.brass/: ai_instructions.yaml (ranked findings for Claude Code or Cursor), detailed_analysis.yaml (full context), and security_report.yaml (audit-only view). Safe to.gitignore, regenerates every scan.

[BrassCoders @BrassCoder]

BrassCoders runs all 12 scanners in under 60 seconds on most Python codebases. Fast enough for a PR check without slowing the merge queue.

The one variable that changes this: Pyre/Pysa taint analysis.

[BrassCoders @BrassCoder]

94% of tested apps have broken access control, OWASP's top finding. BOLA, the API version, drives 27% of attack traffic. AI writes the endpoint, skips the ownership check. Brasscoders flags missing auth decorators and mass-assignment, not the logic call.

[BrassCoders @BrassCoder]

Your AI coding assistant can reproduce license-encumbered code from its training data. GitHub's own Copilot filter flags matches in under 1% of suggestions, a rate that compounds across a team's output over a year. The lawsuit over this has run since 2022, still unresolved.

[BrassCoders @BrassCoder]

brasscoders scan. writes.brass/ai_instructions.yaml: findings ranked CRITICAL to LOW, each with file path, line number, scanner, and confidence score. Paste it into Claude Code or Cursor and ask it to triage. Deterministic findings, AI-context verdicts.

[BrassCoders @BrassCoder]

yaml.load: CVSS 9.8 CVE. torch.load(weights_only=True), the flag PyTorch's own docs called safe: CVSS 9.3, fixed only by upgrading to 2.6.0. Keras's TorchModuleWrapper: same bug, three abstraction layers deeper.

[BrassCoders @BrassCoder]

A regex your AI writes in half a second can hang your server for minutes. Cloudflare lost 27 minutes to one in 2019. Same nested-quantifier shape just landed CVEs in ajv and minimatch. brasscoders runs Semgrep's redos scanner to catch it pre-merge.

[BrassCoders @BrassCoder]

@nk_developer1 Same diff, run twice, and any of these three can flag different things since LLM review isn't deterministic run to run. A static baseline before the AI pass gives you a consistent floor no matter which model wins that week.

[BrassCoders @BrassCoder]

@johnnynelai That admission can be sycophancy in disguise. Push back hard enough and most models fold whether you're right or wrong. Better test: open a fresh session with zero prior context, paste the code cold, see if it flags the same issue unprompted.