TracecatHQ/tracecat

Open-source security automation platform for teams and AI agents

What it solves

Tracecat provides a unified, AI-native platform for security teams to automate cyber defense. It solves the complexity of building and managing AI agents for security operations by integrating case management, deterministic workflows, and a vast library of security tool connectors into one system.

How it works

The platform combines several core components to automate security tasks:

  • Agents and Skills: Users build custom agents using prompts, tools, and sub-agents to handle specific security tasks.
  • Workflows: It uses Temporal to execute deterministic logic and durable workflows, ensuring resilience and scale.
  • MCP Integration: It leverages the Model Context Protocol (MCP) to connect agents to over 50 hosted MCP servers and 100+ pre-built connectors for security tools.
  • Case Management: It tracks and resolves incidents using agent-written verdicts, timelines, and evidence.
  • Sandboxing: To ensure security, untrusted code and agents are executed within nsjail sandboxes or pid runtimes.

Who it’s for

It is designed for AI-native security teams and cybersecurity professionals who need to build autonomous agents for incident response and automate their security operations center (SOC).

Highlights

  • Extensive Connectivity: Includes 100+ pre-built connectors and 50+ hosted MCP servers for security tools.
  • Durable Execution: Built on Temporal for reliable, scalable workflow execution.
  • Secure Runtime: Runs untrusted code in sandboxed environments using nsjail.
  • Flexible Deployment: Supports Tracecat Cloud, self-hosting via Docker/Kubernetes, and fully air-gapped installations.
  • Custom Registry: Allows syncing custom Python scripts from Git repositories directly into the platform.

Related

  • Project
    FankChen/tracecrate

    A privacy-first, client-side workbench for inspecting and comparing AI agent traces to debug agentic workflows without sending data to a backend.

  • Project
    traceroot-ai/traceroot

    TraceRoot is an open‑source platform that records AI agent calls, flags bad behaviour with custom detectors, clusters issues into signals, and runs automated evals so a coding‑agent can suggest and verify fixes, closing a self‑improvement loop. It offers a CLI, Python/TS SDKs, and integrations with major agent frameworks and model providers, and can be used via hosted cloud or self‑hosted Docker Compose.

  • Project
    morpheuslord/HackBot

    An agentic cybersecurity research team that uses multi-agent orchestration and MCP/ACP protocols to analyze security reports and research vulnerabilities.

  • Project
    FunnyWolf/agentic-soc-platform

    An open-source security operations platform that uses Agentic AI to automate alert triage, investigation, and knowledge accumulation for security teams.

  • Project
    aliasrobotics/cai

    An open-source framework for building AI-powered offensive and defensive security automation, used to establish the Cybersecurity AI research domain.