Tracecat

Tracecat is an open source security automation platform, positioned as a SOAR for teams that build with AI agents. It combines workflows, case management and agents in one workspace so security teams can automate alert triage, enrichment and response. It is aimed at engineering minded security teams replacing legacy SOAR tools. Users build tool calling agents with a chosen model, instructions and an allowlist of actions, with human approval required before selected tools run, bounded tool calls and reusable presets and skills. Agents can reach tools through a hosted catalog of MCP servers and prebuilt integrations with products such as CrowdStrike Falcon, Wiz, Okta, Gmail, VirusTotal and Slack. Example use cases on the site include phishing triage, cloud alert enrichment, endpoint isolation, OAuth app review and vulnerability response. Workflows can run from webhooks or schedules, and lookup tables and case records support investigations. It can be self hosted with Docker or on AWS Fargate, and the project is released under the AGPL license. The open source edition is free forever and includes unlimited workflows, cases and agents, a single workspace, SSO and audit trails. The Enterprise edition has custom pricing and adds unlimited multi tenant workspaces, Git sync, RBAC and SCIM, a managed cloud in US or EU regions, Kubernetes deployment, advanced cases, 24 hour a day Slack and email support, and a forward deployed security engineer.