Shuffle vs Tracecat
Shuffle
shuffler.ioTracecat
tracecat.comSide by side
| Figure | Shuffle | Tracecat |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | — |
| Web | Yes | Yes |
| Linux | Yes | — |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 3 | 2 |
| Spec score · Security Orchestration, Automation, and Response Software | 7.6 (#6) | 7.3 (#8) |
| Spec score · Runbook Automation Software | 7.6 (#8) | 7.3 (#13) |
| Founded | 2019 | 2024 |
| Integrations | Shuffle's public app catalog lists more than 2,500 apps, including integrations such as Slack, Gmail, MISP, Wazuh, Splunk, and Jira. | Tracecat advertises 500+ integrations across SIEM, EDR, MDM, identity providers, and other categories. |
| Purpose | Shuffle is an open-source automation platform designed for the security industry, for building and executing automation workflows. | Tracecat is an open source security automation platform for teams and AI agents that helps AI-native security teams build agents and automate cyber defense. |
| Security | The architecture documentation says passwords are bcrypt-hashed and app authentication, protected datastore keys, and files are AES-256 encrypted. | The pricing page lists SSO and organization audit logs for Open Source, and platform audit logs, custom roles, service accounts, and SCIM for Enterprise. |
| Support | The pricing page lists Shuffle Support with SLA and email support for Business, with on-call support and an alert mechanism additionally listed for Enterprise. | Open Source includes Discord community and GitHub issues; Enterprise includes 24/7 Slack and email support and custom SLAs. |
Plans
In their own words
Shuffle
Shuffle is an open-source automation platform for security teams to build and run workflows. Its visual designer works with a no-code app creator that can generate integrations from Swagger or OpenAPI specifications and API documentation URLs. The public catalog contains more than 2,500 apps, including Slack, Gmail, MISP, Wazuh, Splunk, and Jira. Workflows can start through webhooks, schedules, subflows, or user input; extension triggers include AWS Lambda, AWS S3, Kafka, and Pub/Sub.
Deployment choices include self-hosted open source, self-hosted licensed software, Shuffle Cloud, and hybrid setups. Documented runtime architectures include Docker Compose, Docker Swarm, a cloud-hybrid local Orborus runner, and Kubernetes with Helm charts. Shuffle documents bcrypt password hashing, AES-256 encryption, tenant-controlled SAML/SSO and MFA, and a Bearer-token API. The free Scale plan is free and includes 2,000 app runs per month, with a hard limit, three tenants, and one location. Custom Python apps are not yet easy to create for Shuffle Cloud, though on-premises instances support local app hotloading.
Tracecat
Tracecat is an open-source security automation platform for teams building AI-assisted cyber defense. Its product includes workflows, cases, tables, integrations, agent presets, skills, and a hosted MCP server catalog. Workflows can use loops, conditions, parallel subflows, and Python, Bash, or Ansible scripts. Tracecat advertises more than 500 integrations across areas including SIEM, EDR, MDM, and identity providers; its hosted MCP catalog lists 56 servers, including Elastic, Splunk, CrowdStrike Falcon, Wiz, Okta, Slack, Jira, GitHub, and AWS. Teams can use managed cloud or self-host. The Open Source edition can be deployed with Docker or AWS Fargate and is billed Free forever at free, with unlimited workflows, cases, and agents. Open Source includes case management, comments, attachments, and custom fields, but excludes human-in-the-loop tool approvals and advanced case features. Enterprise uses custom pricing and adds features including tool approvals, advanced cases, and 24/7 Slack and email support.