Tracecat
Open source SOAR platform with workflow automation, cases, and AI-assisted playbook building.
Technical Architecture & Overview
Tracecat is an open source security automation platform combining workflow orchestration, case management, and tables in one self-hostable deployment. It ships more than 100 prebuilt connectors and 50 hosted MCP servers for security tools, and playbooks can be defined in natural language. The project markets itself as an open source agentic SOAR.
Targeted Technical Use Cases
Teams that want self-hosted open source SOAR automation without enterprise licensing.
Evaluation & Trade-offs
Core Strengths
- +Self-hostable with Docker, AWS Fargate, or Kubernetes, including air-gapped deployments.
- +Workflows, cases, and lookup tables in one tool.
- +Prompts can be turned into automations through the Tracecat MCP server.
Trade-Offs & Limitations
- -Multi-tenant workspaces, fine-grained access control, and workspace version control require the Enterprise Edition.
- -AGPL licensing needs review for some deployments.
Defensive Security Application
Automating alert triage, investigation, and response actions across security tooling.
Frequently Asked Questions
What is Tracecat?→
Tracecat is an open source security automation platform combining workflow orchestration, case management, and tables in one self-hostable deployment. It ships more than 100 prebuilt connectors and 50 hosted MCP servers for security tools, and playbooks can be defined in natural language. The project markets itself as an open source agentic SOAR.
What is Tracecat used for?→
Teams that want self-hosted open source SOAR automation without enterprise licensing.
What are the strengths of Tracecat?→
- +Self-hostable with Docker, AWS Fargate, or Kubernetes, including air-gapped deployments.
- +Workflows, cases, and lookup tables in one tool.
- +Prompts can be turned into automations through the Tracecat MCP server.
What are the limitations of Tracecat?→
- +Multi-tenant workspaces, fine-grained access control, and workspace version control require the Enterprise Edition.
- +AGPL licensing needs review for some deployments.
How is Tracecat used defensively?→
Automating alert triage, investigation, and response actions across security tooling.