Overview

Tracecat brings agentic AI, workflows, cases, tables, integrations, agent presets, skills, and a hosted MCP server catalog into one platform. The workflow logic includes loops, conditional branches, parallel subflows, and Python, Bash, and Ansible scripts. That flexibility is useful for adapting playbooks to a team's response process, but it favors teams willing to build and maintain automation rather than buyers looking for a turnkey security product.

Teams can use managed cloud or self-host. Open Source supports Docker or AWS Fargate; Enterprise also lists a Kubernetes Helm chart. Tracecat states SOC 2 Type II and describes the product as air-gappable, relevant to organizations with strict deployment needs.

Key features

Workflow automation: Playbook automation and alert enrichment are supported alongside branching, loops, parallel work, and scripts. Those tools can accommodate varied response paths, though they place a premium on the team's ability to design reliable workflows.
Integrations and threat intelligence: Tracecat advertises 500+ integrations across SIEM, EDR, MDM, identity providers, and other categories, and supports threat intel actions. Its hosted MCP catalog lists 56 servers, including Elastic, Splunk, CrowdStrike Falcon, Wiz, Okta, Slack, Jira, GitHub, and AWS. The breadth is valuable for connecting security operations, while the 56-server catalog is a narrower, concrete set of hosted options.
Cases and agents: Open Source includes case management, comments, attachments, and custom fields, as well as unlimited agents. Enterprise adds case tasks, metrics, triggers, correlation, and other advanced case features. Teams can cover basic investigation and tracking without a paid plan, but complex case coordination is a reason to step up.
Approvals and governance: Enterprise provides tool approvals through a unified inbox; human-in-the-loop tool approvals are unavailable on Open Source. Open Source includes SSO and organization audit logs, while Enterprise adds platform audit logs, custom roles, service accounts, and SCIM. The free edition has meaningful security foundations, but organizations requiring approval gates or more granular administration need Enterprise.
Support: Open Source support is through Discord and GitHub issues. Enterprise adds 24/7 Slack and email support and custom SLAs, a material distinction for teams relying on the platform in operational response.

Pricing

Open Source: 0.00 USD per free, billed Free forever. It includes unlimited workflows, cases, and agents, self-hosting, and monthly executions that are self-managed. Tool approvals and the agent inbox, advanced cases, multi-tenant workspaces, Git sync, custom roles and SCIM, and enterprise support are excluded. This is the strongest fit for teams able to operate their own deployment and accept those feature boundaries; execution volume is not a fixed included quota.

Enterprise: custom pricing, billed Custom. It includes unlimited workflows, cases, and agents, cloud in the US or EU or self-hosting, custom-priced monthly executions, 24/7 Slack and email support, and custom SLAs. The feature set also includes approvals and advanced case capabilities. It is aimed at organizations that need those controls and support, but custom pricing makes it a poor fit for buyers who need a predictable published rate.

Platforms

Tracecat is offered as API, self-hosted, and web. Managed cloud is an option, while Open Source can be deployed with Docker or AWS Fargate.

Who it's for

Tracecat is aimed at AI-native security teams, particularly those automating focused Tier 1 and Tier 2 work such as phishing, suspicious OAuth grants, EDR malware alerts, and cloud findings. Its scriptable workflows and integrations make it a sensible choice for teams that can own the automation lifecycle. Teams wanting human approval built into agent actions, advanced case processes, or enterprise support should evaluate Enterprise rather than assume those capabilities come with the free edition.

Pros and cons

Pros: Free forever with unlimited workflows, cases, and agents makes self-hosted experimentation and ongoing use possible without a seat cap in the plan terms.
Pros: Workflow branching, parallel subflows, and multiple scripting languages give security teams room to implement focused response playbooks.
Pros: Open Source combines case basics with SSO and organization audit logs, instead of restricting all case handling and security controls to Enterprise.
Cons: Open Source excludes human-in-the-loop tool approvals and advanced case features, limiting its fit for tightly governed agent operations or complex investigations.
Cons: Monthly executions are self-managed on Open Source, so teams must account for their own execution capacity rather than rely on a stated monthly allowance.
Cons: Community support on the free plan is less direct than Enterprise's 24/7 Slack and email support with custom SLAs.

Alternatives

OpenSOAR is worth considering for buyers who want a free, self-hosted option with Apache 2.0 licensing, no feature gates, and no per-action billing.

Sumo Logic may suit teams looking for a web-based observability service: its free plan provides 20 daily credits for logs, metrics, and traces, seven-day log retention, and up to three users.

Tines is an alternative for teams that prefer a web-based workflow service; its free edition is capped at three live workflows.

Shuffle is another freemium, self-hostable option; its Starter plan is 29.00 USD per month for 10k App Runs and starts free with 2k App-Runs.

Mjolnir SOAR Platform is a paid alternative.

Palo Alto Networks Cortex Cloud API Security is a paid option for API, Linux, and web platforms.

Cyware Security Orchestration and Automation uses custom quotes shaped by deployment model, analyst seats, intelligence feeds, automation volume, sandbox capacity, digital risk protection, and selected add-ons.

Defensys SOAR Platform is a paid alternative.

For broader category comparisons, see SOAR Software and Runbook Automation Software.

Verdict

Tracecat is a strong choice for technically capable AI-native security teams that want broad workflow and basic case tools in a free, self-hosted edition. Its main draw is the combination of flexible automation and substantial free-plan scope; its clearest reason to look elsewhere is the lack of approvals and advanced case capabilities on Open Source. Choose Enterprise when those controls and direct support are operational requirements, or compare other platforms if you need a different deployment or workflow model.

	Swimlane Turbine	Tracecat
Free plan	No	Yes
Free trial	No	No
Paid from	—	Free
Open source	No	No
Platforms	api, Linux, self-hosted, Web	api, self-hosted, Web
Free plan	—	Yes

Swimlane Turbine vs Tracecat

Swimlane Turbine

Tracecat