Skip to content
SPECIFICTION
Get listed

Tracecat

tracecat.com

Free plan WebAPISelf-hosted
Visit tracecat.com
Spec score 7.3 #8 of 24 in Security Orchestration, Automation, and Response Software

What it is

Tracecat is an open-source security automation platform for teams building AI-assisted cyber defense. Its product includes workflows, cases, tables, integrations, agent presets, skills, and a hosted MCP server catalog. Workflows can use loops, conditions, parallel subflows, and Python, Bash, or Ansible scripts. Tracecat advertises more than 500 integrations across areas including SIEM, EDR, MDM, and identity providers; its hosted MCP catalog lists 56 servers, including Elastic, Splunk, CrowdStrike Falcon, Wiz, Okta, Slack, Jira, GitHub, and AWS. Teams can use managed cloud or self-host. The Open Source edition can be deployed with Docker or AWS Fargate and is billed Free forever at free, with unlimited workflows, cases, and agents. Open Source includes case management, comments, attachments, and custom fields, but excludes human-in-the-loop tool approvals and advanced case features. Enterprise uses custom pricing and adds features including tool approvals, advanced cases, and 24/7 Slack and email support.

Spec sheet

Purpose
Tracecat is an open source security automation platform for teams and AI agents that helps AI-native security teams build agents and automate cyber defense.Read 30 Sep 2026 · tracecat.com
Deployment
Tracecat offers managed cloud and self-hosted deployment, with Open Source deployable using Docker or AWS Fargate and Enterprise also listing a Kubernetes Helm chart.Read 30 Sep 2026 · tracecat.com
Integrations
Tracecat advertises 500+ integrations across SIEM, EDR, MDM, identity providers, and other categories.Read 30 Sep 2026 · tracecat.com
Security
The pricing page lists SSO and organization audit logs for Open Source, and platform audit logs, custom roles, service accounts, and SCIM for Enterprise.Read 30 Sep 2026 · tracecat.com
Compliance
Tracecat’s homepage states SOC 2 Type II and describes the product as air-gappable.Read 30 Sep 2026 · tracecat.com
Support
Open Source includes Discord community and GitHub issues; Enterprise includes 24/7 Slack and email support and custom SLAs.Read 30 Sep 2026 · tracecat.com
Headquarters
New York City, New York, United StatesRead 28 Sep 2026 · tracecat.com
Founded
2024Read 28 Sep 2026 · tracecat.com
Agent approvals
Enterprise includes tool approvals with a unified inbox, while the pricing comparison marks human-in-the-loop tool approvals as unavailable on Open Source.Read 30 Sep 2026 · tracecat.com
Cases
Open Source includes case management, comments, attachments, and custom fields, while Enterprise adds case tasks, metrics, triggers, correlation, and other advanced case features.Read 30 Sep 2026 · tracecat.com
Company location and founding
Y Combinator lists Tracecat as founded in 2024 and located in New York City, NY.Read 30 Sep 2026 · ycombinator.com
Hosted MCP catalog
The MCP catalog page lists 56 hosted servers, including Elastic, Splunk, CrowdStrike Falcon, Wiz, Okta, Slack, Jira, GitHub, and AWS.Read 30 Sep 2026 · tracecat.com
Product scope
The open source product includes agentic AI, workflows, cases, tables, integrations, agent presets, skills, and a hosted MCP server catalog.Read 30 Sep 2026 · tracecat.com
Who it is for
Tracecat describes its target users as AI-native security teams and says the platform supports focused Tier 1 and Tier 2 workflows such as phishing, suspicious OAuth grants, EDR malware alerts, and cloud findings.Read 30 Sep 2026 · tracecat.com
Workflow tools
Workflows support loops, if-conditions, parallel subflows, and Python, Bash, and Ansible scripts.Read 30 Sep 2026 · tracecat.com

Plans and prices

Open Source Free Free forever Unlimited workflows, cases, and agents · Self-hosted · Monthly executions self-managed · Tool approvals and agent inbox, advanced cases, multi-tenant workspaces, Git sync, custom roles and SCIM, and enterprise support excluded Read 30 Sep 2026 · tracecat.com
Enterprise Priced on request Custom Unlimited workflows, cases, and agents · Cloud (US / EU) or self-hosted · Monthly executions custom pricing · 24/7 Slack and email support · Custom SLAs Read 30 Sep 2026 · tracecat.com

Every Tracecat plan and price →

Strong points and limits

Strong points

  • Open Source includes unlimited workflows, cases, and agents
  • Workflows support loops and parallel subflows
  • Supports Python, Bash, and Ansible scripts
  • Advertises 500+ integrations
  • Can deploy with Docker or AWS Fargate

Limits

  • Open Source excludes human-in-the-loop tool approvals
  • Advanced case features are excluded from Open Source
  • Enterprise pricing is custom

Who it suits

Tracecat is aimed at AI-native security teams automating cyber defense, including focused Tier 1 and Tier 2 workflows such as phishing and malware alerts. It may suit teams seeking self-hosted or managed-cloud deployment options.

Verdict

Tracecat provides workflow automation and case management in a free, self-hosted Open Source plan. Teams needing tool approvals, advanced case capabilities, or enterprise support must consider the custom-priced Enterprise plan.

Where Specifiction places it

Alternatives to TracecatAll alternatives →