The agentic security automation platform.
Tracecat is the open source security automation platform for teams and AI agents. A unified platform with everything AI-native security teams need to build agents and automate cyber defense.
Unlimited agents, cases, lookup tables, and workflows.
Agents and skills — build custom agents with prompts, tools, MCP, and skills |
Case management — track, automate, and resolve incidents with agents |
Workflows — execute deterministic logic with resilience and scale on Temporal |
Tables — store and query structured data |
Tracecat MCP — turn prompts into automations from Claude Code, Codex, Copilot, and more |
Integrations — 100+ pre-built connectors and 50+ hosted MCP servers for security tools |
- Pre-built MCP servers: 50+ Tracecat-hosted MCP servers for security operations
- MCP client: connect custom agents any MCP server (remote HTTP / OAuth or local via
npx/uvxcommands) - Custom registry: sync custom Python scripts from your Git repo into Tracecat
- Sandboxed: run untrusted code and agents within
nsjailsandboxes orpidruntimes - Durable execution: built on Temporal for resilience and scale
- Variables: reuse values across workflows and agents
- No SSO tax: SAML / OIDC support
- Free audit logs: exportable into your SIEM
- Deploy anywhere: sign up for Tracecat Cloud, or self-host with Docker, AWS Fargate, or Kubernetes. Runs fully air-gapped.
- Multi-tenant: isoated different teams and dev / prod environments into workspaces
- Fine-grained access control: RBAC, ABAC, OAuth2.0 scopes for humans and agents
- Human-in-the-loop: review and approve sensitive tools calls from a unified inbox, Slack, or email
- Workspace version control: sync workflows, agents, and table schemas to GitHub, GitLab, Bitbucket, etc.
- Metrics and monitoring: for workflows, agents, and cases
This repo is available under the AGPL-3.0 license except for:
- Code under the
packages/tracecat-eedirectory - Code that gates
eefeatures
These exceptions are fall under Tracecat's paid EE (Enterprise Edition) license. Code that fall under the above exceptions must not be redistributed, sold, used in production, or otherwise commercialized without permission.
Note
Tracecat Enterprise is available as managed Cloud with US or EU hosting, or as a self-hosted deployment with dedicated support. Book a demo today.
Have questions? Feedback? Come hang out with us in the Tracecat Community Discord.
- Backend: Python with FastAPI, SQLAlchemy, Pydantic, uv
- Frontend: Next.js with TypeScript, React Query, Shadcn UI
- Durable workflows and jobs: Temporal
- Sandbox: nsjail
- Database: PostgreSQL
- Object store: S3-compatible
Thank you all our amazing contributors for contributing code, integrations, docs, and support. Open source is only possible because of you. Check out our Contribution Guide for more information.
Tracecat is distributed under AGPL-3.0
