Tracecat
Tracecat · Productivity
Tracecat is an open source security automation platform that combines visual workflows, case management, and AI agents so security teams can triage alerts and run response playbooks faster.
About Tracecat
What Is Tracecat
Tracecat is a security automation platform built for the work that piles up between an alert firing and someone closing the ticket. It brings three things into one place: a workflow builder for repeatable response steps, a case system for tracking incidents, and AI agents that can call security tools on their own.
The pitch is straightforward. Most teams don't lack alerts, they lack hands. A SOC analyst spends the day copying indicators between consoles, opening tickets, and writing the same Slack update for the fifth time. Tracecat turns those steps into a workflow or an agent run, then keeps a record of what happened.
It started as an open source SOAR project aimed at the security orchestration work that commercial tools price per seat, and it's still licensed under AGPL-3.0, with an enterprise edition sold separately. The company reports about 3,900 GitHub stars and ships code most weeks. The code base is Python on the backend and Next.js on the frontend, with Temporal handling durable execution.
Getting Started
- Pick a deployment: sign up for Tracecat Cloud, or self-host with Docker Compose, the Kubernetes Helm chart, or AWS Fargate.
- Connect credentials for the tools you already run, such as an EDR, a ticketing system, or a threat intelligence feed. OAuth integrations and API key based connections both work.
- Build a workflow in the visual builder, then attach a trigger. Webhooks, schedules, and case events can all start a run.
- Add an AI agent if you want judgment in the loop. Give it a prompt, a set of tools or MCP servers, and an approval gate for anything destructive.
- Open a case, let the workflow or agent write its findings into the timeline, and review the result before closing it.
Product Information
A quick look at Tracecat's pricing, supported platforms, and performance.
Best for
The users, tasks, and scenarios where this tool fits best.
Users
- Small security teams without a SOAR budget
- SOC analysts drowning in repetitive triage
- Detection engineers who prefer code
- Platform or IT ops teams doing security adjacent work
Tasks
- Alert enrichment and routing
- Phishing report handling
- Identity incident response
- Recurring compliance checks
Scenarios
- A single analyst covering nights and weekends
- Regulated environments that can't send data out
- Teams migrating off a per seat SOAR
Key features
Visual Workflow Builder on Temporal
Workflows are drawn as a graph of connected actions, then executed by Temporal, which handles retries, timeouts, and long running steps without losing state. You can branch on conditions, loop over a list of indicators, and drop into Python when a task needs real code. Webhooks provide the HTTP entry point, so any tool that can send a request can start a run.
AI Agents With Tools, Skills, and Subagents
Agent presets bundle a prompt, a model, a tool set, and optional skills, and each version can be published and pinned. An agent can call native integrations, remote MCP servers, or a local command through npx or uvx. Subagents split a job into pieces, and approval gates hold risky tool calls until a person signs off in the agent inbox, Slack, or Teams.
Case Management With an Agent Copilot
Cases collect the alert, the evidence, the timeline, and the people working on it. Custom fields and dropdowns match your own severity scale, tasks carry owners and due dates, and sub cases link related incidents. A case copilot summarizes what happened and drafts a verdict, which helps when the next shift picks up an incident cold.
Prebuilt Integrations and Hosted MCP Servers
There are more than 100 prebuilt connectors for security tools and 50 or more MCP servers hosted by Tracecat, covering the usual suspects in endpoint, identity, cloud, and threat intelligence. A built in MCP client also connects custom agents to any remote server over HTTP or OAuth, and Tracecat exposes its own MCP tools, so you can ask Claude Code or Copilot to list open critical cases and get a real answer.
Workspace Tables and Custom Registry
Tables store structured data inside the workspace: an entity table of assets and accounts, an observations table of what you've learned about them, or a plain lookup list of approved domains. The custom registry syncs Python scripts from your Git repository, so private logic lives in version control and still runs inside Tracecat.
Access Control, Audit Logs, and Air-Gapped Deploys
Role based access control, custom roles and groups, service accounts, and API keys cover who can do what, and SAML or OIDC single sign on is included rather than sold as an upgrade. Organization audit logs export into a SIEM, which matters for SOC 2 evidence. For sensitive networks, the platform runs fully air-gapped with no outbound calls required.
Pros and cons
Pros
- Free self-hosted edition with unlimited users, workflows, and cases, which is unusual at this level of polish.
- Workflows, cases, and agents share one data model, so an agent's finding lands in the same case timeline a human reviews.
- Durable execution on Temporal means a workflow survives a worker restart mid run instead of starting over.
- SSO, audit logs, and RBAC sit in the base product, with no separate compliance tier to buy.
- Air-gapped and Kubernetes deployments cover defense and regulated customers that SaaS tools can't reach.
Cons
- The Team plan starts at $50,000 per year, so the jump from free self-hosting to managed cloud is steep for a small shop.
- Self-hosting means you own upgrades, Postgres, object storage, and Temporal. That's a real workload for a team without a platform engineer.
- The agent features assume you already know which tools to expose and what a good verdict looks like. A weak prompt produces confident nonsense.
- Documentation lags the release cadence in places, and the fastest answers often come from Discord rather than the docs site.
Frequently asked questions
Yes, in the self-hosted open source edition, which is licensed under AGPL-3.0 and includes unlimited workflows, agents, cases, and users. It comes with one workspace and no support SLA. The managed Team plan costs $50,000 per year with 150,000 executions per month included, and Enterprise pricing is quoted per deal.
Related content
Explore related tools, skills, and articles for Tracecat.
Tracecat Alternatives
Base Code
Base44 (Wix) · Coding · ProductivityBase Code is a shared cloud development environment from Base44. Teammates describe changes to an existing GitHub codebase in chat, preview them live and send them back as pull requests.
Knocket
Knocket (Tencent RTC team) · Productivity · Business · ChatbotKnocket is a free live chat and contact page tool that lets visitors message you from your website, app, or a shareable link, with every reply handled from Telegram or one inbox.
FloorGen
Vinit Kumar (FloorGen) · Productivity · China AIFloorGen is a browser-based floor plan maker that turns a sentence or a sketch into an editable 2D plan and a 3D walkthrough. Export to PDF, DXF or video, and draw without an account.