Tracecat

Tracecat is an open-source security automation platform for teams and AI agents working on cyber defense. Its product includes workflows, cases, tables, integrations, agent presets, skills, and a hosted MCP server catalog. Workflows support loops, conditional steps, parallel subflows, and scripts in Python, Bash, and Ansible. Tracecat advertises more than 500 integrations across SIEM, EDR, MDM, identity, and other areas; its MCP catalog lists 56 hosted servers, including Elastic, Splunk, CrowdStrike Falcon, Wiz, Okta, Slack, Jira, GitHub, and AWS. Teams can use managed cloud or self-host. The Open Source edition can be deployed with Docker or AWS Fargate and includes unlimited workflows, cases, and agents at no cost, billed Free forever. Open Source also includes case management with comments, attachments, and custom fields. Enterprise has custom pricing and offers cloud in the US or EU, or self-hosting, plus 24/7 Slack and email support. Tracecat states SOC 2 Type II and describes the product as air-gappable.

Tracecat offers self-hosting and a free Open Source edition with broad workflow tools and case management. Teams needing tool approvals or advanced case features should note those are not included in Open Source.

Tracecat is aimed at AI-native security teams automating focused Tier 1 and Tier 2 work, including phishing, suspicious OAuth grants, EDR malware alerts, and cloud findings. It may suit teams that want a self-hosted open-source option or managed cloud.

Tracecat is a security automation platform for teams building AI-assisted cyber defense. It suits AI-native security teams with the engineering capacity to shape and maintain their own workflows. Its free edition is unusually broad for self-hosted use, but teams that need approvals or deeper case operations will have to consider Enterprise.

Overview

Tracecat brings agentic AI, workflows, cases, tables, integrations, agent presets, skills, and a hosted MCP server catalog into one platform. The workflow logic includes loops, conditional branches, parallel subflows, and Python, Bash, and Ansible scripts. That flexibility is useful for adapting playbooks to a team's response process, but it favors teams willing to build and maintain automation rather than buyers looking for a turnkey security product.

Teams can use managed cloud or self-host. Open Source supports Docker or AWS Fargate; Enterprise also lists a Kubernetes Helm chart. Tracecat states SOC 2 Type II and describes the product as air-gappable, relevant to organizations with strict deployment needs.

Key features

• Workflow automation: Playbook automation and alert enrichment are supported alongside branching, loops, parallel work, and scripts. Those tools can accommodate varied response paths, though they place a premium on the team's ability to design reliable workflows.
• Integrations and threat intelligence: Tracecat advertises 500+ integrations across SIEM, EDR, MDM, identity providers, and other categories, and supports threat intel actions. Its hosted MCP catalog lists 56 servers, including Elastic, Splunk, CrowdStrike Falcon, Wiz, Okta, Slack, Jira, GitHub, and AWS. The breadth is valuable for connecting security operations, while the 56-server catalog is a narrower, concrete set of hosted options.
• Cases and agents: Open Source includes case management, comments, attachments, and custom fields, as well as unlimited agents. Enterprise adds case tasks, metrics, triggers, correlation, and other advanced case features. Teams can cover basic investigation and tracking without a paid plan, but complex case coordination is a reason to step up.
• Approvals and governance: Enterprise provides tool approvals through a unified inbox; human-in-the-loop tool approvals are unavailable on Open Source. Open Source includes SSO and organization audit logs, while Enterprise adds platform audit logs, custom roles, service accounts, and SCIM. The free edition has meaningful security foundations, but organizations requiring approval gates or more granular administration need Enterprise.
• Support: Open Source support is through Discord and GitHub issues. Enterprise adds 24/7 Slack and email support and custom SLAs, a material distinction for teams relying on the platform in operational response.

Pricing

Open Source: free, billed Free forever. It includes unlimited workflows, cases, and agents, self-hosting, and monthly executions that are self-managed. Tool approvals and the agent inbox, advanced cases, multi-tenant workspaces, Git sync, custom roles and SCIM, and enterprise support are excluded. This is the strongest fit for teams able to operate their own deployment and accept those feature boundaries; execution volume is not a fixed included quota.

Enterprise: custom pricing, billed Custom. It includes unlimited workflows, cases, and agents, cloud in the US or EU or self-hosting, custom-priced monthly executions, 24/7 Slack and email support, and custom SLAs. The feature set also includes approvals and advanced case capabilities. It is aimed at organizations that need those controls and support, but custom pricing makes it a poor fit for buyers who need a predictable published rate.

Platforms

Tracecat is offered as API, self-hosted, and web. Managed cloud is an option, while Open Source can be deployed with Docker or AWS Fargate.

Who it's for

Tracecat is aimed at AI-native security teams, particularly those automating focused Tier 1 and Tier 2 work such as phishing, suspicious OAuth grants, EDR malware alerts, and cloud findings. Its scriptable workflows and integrations make it a sensible choice for teams that can own the automation lifecycle. Teams wanting human approval built into agent actions, advanced case processes, or enterprise support should evaluate Enterprise rather than assume those capabilities come with the free edition.

Pros and cons

• Pros: Free forever with unlimited workflows, cases, and agents makes self-hosted experimentation and ongoing use possible without a seat cap in the plan terms.
• Pros: Workflow branching, parallel subflows, and multiple scripting languages give security teams room to implement focused response playbooks.
• Pros: Open Source combines case basics with SSO and organization audit logs, instead of restricting all case handling and security controls to Enterprise.
• Cons: Open Source excludes human-in-the-loop tool approvals and advanced case features, limiting its fit for tightly governed agent operations or complex investigations.
• Cons: Monthly executions are self-managed on Open Source, so teams must account for their own execution capacity rather than rely on a stated monthly allowance.
• Cons: Community support on the free plan is less direct than Enterprise's 24/7 Slack and email support with custom SLAs.

Alternatives

OpenSOAR is worth considering for buyers who want a free, self-hosted option with Apache 2.0 licensing, no feature gates, and no per-action billing.

Sumo Logic may suit teams looking for a web-based observability service: its free plan provides 20 daily credits for logs, metrics, and traces, seven-day log retention, and up to three users.

Tines is an alternative for teams that prefer a web-based workflow service; its free edition is capped at three live workflows.

Shuffle is another freemium, self-hostable option; its Starter plan is $29 a month for 10k App Runs and starts free with 2k App-Runs.

Mjolnir SOAR Platform is a paid alternative.

Palo Alto Networks Cortex Cloud API Security is a paid option for API, Linux, and web platforms.

Cyware Security Orchestration and Automation uses custom quotes shaped by deployment model, analyst seats, intelligence feeds, automation volume, sandbox capacity, digital risk protection, and selected add-ons.

Defensys SOAR Platform is a paid alternative.

For broader category comparisons, see SOAR Software and Runbook Automation Software.

Verdict

Tracecat is a strong choice for technically capable AI-native security teams that want broad workflow and basic case tools in a free, self-hosted edition. Its main draw is the combination of flexible automation and substantial free-plan scope; its clearest reason to look elsewhere is the lack of approvals and advanced case capabilities on Open Source. Choose Enterprise when those controls and direct support are operational requirements, or compare other platforms if you need a different deployment or workflow model.