Tracecat

Tracecat is an open-source, self-hosted web application designed for security automation and orchestration. It provides a platform for security teams to build automated playbooks and manage cases using a combination of AI agents and low-code workflows. The software is deployed as a server application via Docker, AWS Fargate, or Kubernetes Helm, allowing teams to maintain control over their security infrastructure.

Users can create end-to-end automations by integrating custom Python scripts from Git repositories or by using a visual builder. The platform manages the entire lifecycle of security incidents, from initial detection and data lookup to resolution and case tracking. It is designed for security operations centers and teams requiring a centralized hub for security orchestration, automation, and response, enabling the transition from manual tasks to automated agentic workflows.

Key features

• Low-code workflow builder with support for loops and conditional logic
• Custom AI agents created with specific prompts, tools, and chat interfaces
• Case management system to track and resolve security work items
• Over 100 pre-built connectors for enterprise tools via HTTP, SMTP, and gRPC
• Integration with Model Context Protocol (MCP) to turn prompts into automations
• Sandboxed execution of untrusted code and agents using nsjail
• Structured data storage and querying through lookup tables
• SAML and OIDC support for identity management
• Exportable audit logs for integration into existing SIEM systems

The backend is built with Python, FastAPI, and Pydantic, while the frontend uses Next.js and TypeScript. It utilizes Temporal for durable workflow execution and PostgreSQL for data storage, ensuring that long-running security processes are reliable and scalable. The architecture allows for the conversion of custom Python scripts into agent tools and workflow steps through a custom registry, which allows security engineers to extend the platform with their own proprietary logic.

Tracecat is an agentic security automation platform that bridges the gap between manual case management and autonomous AI-driven security operations.