Repolode
Submit
TracecatHQ

TracecatHQ/tracecat

Open-source security automation platform where security teams and AI agents build workflows, manage cases, and respond to incidents.

Open-source alternative to:TinesSplunk SOAR

View on GitHubWebsite
Stars
3,895
Forks
439
Open issues
187
Last commit
17 hours ago

What is it?

Tracecat is a security automation platform that combines AI agents, case management, workflows, and structured tables in one place. Teams can build custom agents with prompts, tools, MCP servers, and subagents, then use them to triage alerts, summarize cases, and draft verdicts.

Deterministic logic runs as workflows built on Temporal, which provides durable execution and retries. Untrusted code and agents can run inside nsjail sandboxes or pid runtimes. The platform ships with 100+ pre-built connectors and 50+ hosted MCP servers for security tools, and it can also sync custom Python scripts from a Git repository.

The core is licensed under AGPL-3.0, with a separate commercial Enterprise Edition covering multi-tenant workspaces, RBAC and ABAC access control, and human-in-the-loop approvals. It can be self-hosted with Docker, AWS Fargate, or Kubernetes, including air-gapped deployments.

Key features

  • 01Build custom AI agents with prompts, tools, MCP, subagents, and skills.
  • 02Track and resolve security incidents with case management.
  • 03Run deterministic workflows durably on Temporal.
  • 04Connect to 100+ pre-built connectors and 50+ hosted MCP servers.
  • 05Execute untrusted code in nsjail or pid sandboxes.
  • 06Export audit logs to a SIEM and authenticate with SAML or OIDC.

Use cases

  • Automating triage and enrichment of security alerts with AI agents.
  • Coordinating incident response by tracking cases and their evidence in one place.
  • Letting Claude Code or Codex create security automations through MCP.
  • Self-hosting security automation in air-gapped or regulated environments.

Quick start

  1. 1

    Sign up for Tracecat Cloud, or self-host with Docker by following the docs

Things to know

  • Licensed under AGPL-3.0, a copyleft license that requires sharing modifications when distributed or offered as a network service.
  • The packages/tracecat-ee directory and ee-gated features fall under a paid license and must not be used in production without permission.
  • Self-hosting depends on several services, including Temporal, PostgreSQL, and S3-compatible storage.

In collections

Open-source AI agent frameworks & appsMCP servers

Topics

#security-automation#ai-agents#incident-response#soar#workflow-orchestration#mcp#temporal#case-management#agents#automation

FAQ

What is tracecat?
Open-source security automation platform where security teams and AI agents build workflows, manage cases, and respond to incidents. Tracecat is a security automation platform that combines AI agents, case management, workflows, and structured tables in one place. Teams can build custom agents with prompts, tools, MCP servers, and subagents, then use them to triage alerts, summarize cases, and draft verdicts.
Is tracecat free to use? What license does it have?
tracecat is open source under the AGPL-3.0 license. Check the license terms before using it in commercial products.
Is tracecat still maintained?
Actively maintained. The last commit to tracecat was on Nov 7, 2026.
What can I use tracecat for?
Automating triage and enrichment of security alerts with AI agents. Coordinating incident response by tracking cases and their evidence in one place. Letting Claude Code or Codex create security automations through MCP. Self-hosting security automation in air-gapped or regulated environments.
How do I install tracecat?
Sign up for Tracecat Cloud, or self-host with Docker by following the docs
Where can I get tracecat?
The source code and installation instructions are on GitHub: https://github.com/TracecatHQ/tracecat

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects