Tracecat

Tracecat is an open source security automation platform that lets teams build workflows, manage cases, and run AI agents for cyber defense.

Tracecat is an open-source security automation and SOAR platform built for AI-native security teams. It helps users build workflows, manage cases, and deploy agents to automate cyber defense tasks like phishing triage, cloud alert enrichment, and endpoint isolation. Teams can use natural language prompts via Claude or Cursor to draft workflows, agent skills, and tool integrations. The platform features 500+ integrations across SIEM, EDR, MDM, IdP, and more, alongside 50+ pre-built Model Context Protocol servers. Users can write custom Python scripts, sync everything to Git, and enforce human approvals on sensitive tool calls.

Tracecat at a glance

Best for: Software engineer
Runs on: Web, API, Self-hosted
Pricing: Open Source plan is free forever; Enterprise plan has custom pricing.
Released: February 2024
Category: AI agent tool
Website: tracecat.com

Key features

Build workflows and manage cases
Deploy AI agents for cyber defense
Connect 50+ pre-built MCP servers
Integrate across SIEM, EDR, MDM, and IdP
Enforce human approvals on sensitive actions
Sync prompts and workflows to Git
Run custom Python and Bash scripts

Use it for

Triage user-reported phishing emails
Enrich cloud alerts and device findings
Isolate endpoints from Falcon alerts
Audit GitHub and Google OAuth app installs

Alternatives to Tracecat

Tracequest — It groups failed tool calls, estimates costs, and reads multiple coding agent formats.
dots — Uses a patched Firefox engine to bypass detection and web blocks.
TraceRoot — Closes the self-improving loop for coding agents using production traces and evals.
ARTEX — Manages autonomous penetration testing tasks and tracks vulnerability progress.
Tracely — Turns production failures into regression tests that block pull requests.
Numbat — It enables local detection and blocking of AI agent actions on endpoints.
Agentic Bug Hunter — It drives the reconnaissance, triage and reporting loop an agent would run.
CyberStrike — Autonomous AI agents execute recon, web, network, and cloud penetration testing.
Runway — Control Claude Code and Codex sessions on local or cloud machines from any phone.
Vigil — Drives end-to-end security engagements with specialist agents and a shared Kali container.
Composio — Equips AI agents with tools, managed user auth, and sandboxes across 1,500+ apps
AiSOC — Runs locally without API keys with bundled models and auditable reasoning ledgers.

All Tracecat alternatives