Tracecat
Tracecat is an open-source security automation platform that lets security teams and AI agents build automations from natural language prompts. It combines agents, workflows, case management, and integrations in one place, with sandboxing and durable execution for reliability. It is designed for security teams looking to automate incident response, threat hunting, and other security operations.
✨ Key features
- Prompt-to-automations: build automations from natural language via agent harnesses.
- Code-native: sync custom Python scripts from Git into Tracecat.
- All-in-one: agents, workflows, tables, and case management.
- 100+ pre-built integrations via HTTP, SMTP, gRPC, OAuth.
- Sandboxed execution with nsjail and durable workflows via Temporal.
- MCP client and server for connecting custom agents.
🎯 Use cases
- Automate incident triage and response workflows.
- Build custom security agents that interact with enterprise tools.
- Create and manage cases with automated enrichment and resolution.
- Turn Python scripts into reusable agent tools and workflow steps.
- Connect to MCP servers for extended tool capabilities.
📦 Installation
🧰 Requirements: Requires Python 3.10+, Node.js 18+, Docker (for self-hosting), and a PostgreSQL database. For managed Cloud, sign up at tracecat.com.
git clone https://github.com/TracecatHQ/tracecat.git
cd tracecatcd backend
python -m venv .venv
source .venv/bin/activate
pip install -r requirements.txtcd ../frontend
npm installFor Docker deployment, see the Docker documentation.
🚀 Usage
# Example: Create a simple workflow using the Tracecat SDK
from tracecat import TracecatClient
client = TracecatClient()
workflow = client.workflows.create(
name="My Workflow",
description="Automate alert triage"
)
print(f"Workflow created: {workflow.id}")
For a full quickstart, refer to the Quickstart Guide.
⚠️ Good to know
Tracecat is in active development; review the changelog before updating. The repository is AGPL-3.0 licensed with enterprise features under a separate paid license.
❓ FAQ
What are the deployment options?
You can use Tracecat managed Cloud (US or EU hosting) or self-host with Docker, AWS Fargate, or Kubernetes Helm.
How does Tracecat ensure security when running untrusted code?
It uses nsjail sandboxes by default, and also supports pid runtimes for isolation.
Can I extend Tracecat with custom Python scripts?
Yes, you can sync custom Python scripts from your Git repo and turn them into agent tools and workflow steps via the custom registry.
What is the licensing model?
The core is AGPL-3.0, but the packages/tracecat-ee directory and code gating enterprise features are under a paid Enterprise Edition license.
📊 Repository
🤖 Overview, features, install steps and FAQ were generated from the project's README on Sep 4, 2026. Always check the original source before running commands.