[opensourcedex]

Tracecat is a free, open source threat detection & response project written in Python and released under AGPL-3.0. It has 3,804 GitHub stars, 416 forks and 137 open issues, and was last pushed 3 hours ago. On this registry it ranks #2 of 2 tracked projects in Threat Detection & Response, with 5 head-to-head comparisons available. It gained 5 stars over the last 6 tracked days.

What is Tracecat?

What it is

Tracecat is an open-source security automation platform for teams and AI agents. It lives in the security operations and incident-response ecosystem, combining agents, workflows, lookup tables, and case management in one Python application. The project is licensed under AGPL-3.0, with a separate paid Enterprise Edition directory and feature gates.

The problem it solves is fragmented security automation. Teams often connect alerts, investigations, enrichment, response actions, and case records across many tools. Tracecat lets builders create prompt-to-automations, sync custom Python scripts from a Git repository, and run work through durable workflows backed by Temporal. Agents and workflows can act on cases, while untrusted code runs in nsjail or pid sandboxes.

Key capabilities

  • Agents are built with prompts, tools, and chat, so teams can create custom assistants for investigation or response.
  • Workflows use a low-code builder with if-conditions, loops, and durable execution through Temporal.
  • Case management tracks, automates, and resolves work items with agents and workflows.
  • Integrations include more than 100 pre-built connectors for enterprise tools through HTTP, SMTP, gRPC, and OAuth.
  • Tracecat MCP turns prompts into automations through agent harnesses such as Claude Code, Codex, and Copilot, while an MCP client connects custom agents to remote or local MCP servers.
  • A custom registry turns Python scripts into agent tools and workflow steps, and lookup tables store and query structured data.
  • Audit logs can be exported into a SIEM, and SAML or OIDC support is included without a separate SSO tax.

Who uses it and how

  • Security builders create investigation workflows that start from alerts or prompts and use connectors to gather context from enterprise systems.
  • Teams automate case handling by linking agents, workflows, lookup tables, and case records in one platform.
  • Developers sync custom Python scripts from a Git repository and expose them as tools for agents or workflow steps.
  • Self-hosters deploy the platform on Docker, AWS Fargate, or Kubernetes Helm, with PostgreSQL and an S3-compatible object store.

Getting started

Typical deployment uses Tracecat managed Cloud, or self-hosting with Docker, AWS Fargate, or Kubernetes Helm. The stack runs Python and FastAPI on the backend, Next.js on the frontend, Temporal for durable workflows, PostgreSQL, and an S3-compatible object store.

When to use it — and when not to

Tracecat is useful when a security team wants one open-source platform for agents, workflows, cases, tables, and custom Python tooling with sandboxing and durable execution. It is less suitable when an organization needs Enterprise-only capabilities listed in the README, such as hosted MCP servers, fine-grained access control, human-in-the-loop approvals, workspace version control, or metrics and monitoring, because those require a valid Tracecat Enterprise License for production use. Self-hosters must operate the database, object store, Temporal, sandbox runtime, and authentication stack, and the project is in active development, so release notes should be reviewed before updates.

project readme (upstream, from github) — read inline

The agentic security automation platform.


Commits License Discord

Introduction

Tracecat is the open source security automation platform for teams and AI agents.

  • Prompt-to-automations: build end-to-end automations with agents, workflows, cases, and tables from your own agent harness (e.g. Claude code, Codex, OpenCode).
  • Code-native: sync custom Python scripts from your Git repo into Tracecat.
  • All-in-one: agents, workflows, lookup tables, and case management. Everything security teams need to automate work in one place.
  • Deployment options: sign up for Tracecat managed Cloud, or self-host with Docker, AWS Fargate, or Kubernetes Helm.

Sandboxed-by-default with nsjail and run on Temporal for security, reliability, and scale.

Features

[!IMPORTANT] Tracecat is in active development. Review the release changelog before updating.

Key Capabilities

  • Agents: build custom agents with prompts, tools, and chat
  • Workflows: low-code builder with complex control flow (if-conditions, loops) and durable execution (Temporal)
  • Case management: track, automate, and resolve work items with agents and workflows
  • Integrations: over 100+ pre-built connectors to enterprise tools via HTTP, SMTP, gRPC, OAuth, and more
  • Tracecat MCP: turns prompts into automations through Claude Code, Codex, Copilot, etc.
  • MCP client: connect custom agents any MCP server (remote HTTP / OAuth or local via npx / uvx commands)
  • Custom registry: turn custom Python scripts into agent tools and workflow steps

Other OSS Highlights

  • Sandboxed: run untrusted code and agents within nsjail sandboxes or pid runtimes.
  • Lookup tables: store and query structured data
  • Variables: reuse values across workflows and agents
  • No SSO tax: SAML / OIDC support
  • Audit logs: exportable into your SIEM

Enterprise Edition

  • Pre-built MCP servers: over 100+ Tracecat hosted MCP servers for security operations
  • Fine-grained access control: RBAC, ABAC, OAuth2.0 scopes for humans and agents
  • Human-in-the-loop: review and approve sensitive tools calls from a unified inbox, Slack, or email
  • Workspace version control: sync workflows, agents, and table schemas to GitHub, GitLab, Bitbucket, etc.
  • Metrics and monitoring: for workflows, agents, and cases

Tech Stack

  • Backend: Python with FastAPI, SQLAlchemy, Pydantic, uv
  • Frontend: Next.js with TypeScript, React Query, Shadcn UI
  • Durable workflows and jobs: Temporal
  • Sandbox: nsjail
  • Database: PostgreSQL
  • Object store: S3-compatible

Open Source vs Enterprise

[!NOTE] Tracecat Enterprise is available as managed Cloud with US or EU hosting, or as a self-hosted deployment with dedicated support. Book a demo today.

This repo is available under the AGPL-3.0 license with the following exceptions:

  • The packages/tracecat-ee directory and code that gates ee features across the repo are under Tracecat's paid EE (Enterprise Edition) license. Production use requires a valid Tracecat Enterprise License.

Code that fall under the above exceptions must not be redistributed, sold, or otherwise commercialized without permission.

If you are interested in Tracecat's Enterprise License or managed Cloud offering, check out our website or book a meeting with us.

Community

Have questions? Feedback? Come hang out with us in the Tracecat Community Discord.

Contributors

Thank you all our amazing contributors for contributing code, integrations, docs, and support. Open source is only possible because of you. Check out our Contribution Guide for more information.



Tracecat is distributed under AGPL-3.0

Frequently asked questions

Is Tracecat free to use?

Tracecat is open source under the AGPL-3.0 licence. There is no licence fee and no seat count — you can self-host it or, where the project offers one, pay a vendor for a managed version instead.

What does Tracecat do?

Open source security automation platform for builders

What is Tracecat written in?

Tracecat is primarily written in Python. Its source is publicly available at https://github.com/TracecatHQ/tracecat, and it has 3,804 GitHub stars.