Tracecat

Overview

Tracecat brings agentic AI, workflows, cases, tables, integrations, agent presets, skills and a hosted MCP server catalog into one platform. Workflow logic includes loops, conditional branches, parallel subflows, and Python, Bash and Ansible scripts. That flexibility supports tailored playbooks, but makes the platform a better fit for teams able to build and maintain automation than for those seeking a turnkey tool.

Deployment can be managed in the cloud or self-hosted. Open Source supports Docker and AWS Fargate; Enterprise also offers a Kubernetes Helm chart. Tracecat states SOC 2 Type II and describes the platform as air-gappable, relevant to teams with stringent security or deployment requirements.

Key features

• Workflow automation: Playbook automation, alert enrichment and threat-intelligence actions cover core security operations work. Loops, conditions, parallel subflows and scripting give technical teams control over response logic, while requiring them to own the workflow design.
• Integrations: Tracecat advertises 500+ integrations spanning SIEM, EDR, MDM, identity providers and other categories. Its hosted MCP catalog lists 56 servers, including Elastic, Splunk, CrowdStrike Falcon, Wiz, Okta, Slack, Jira, GitHub and AWS. That breadth can connect security work to adjacent systems, though the catalog's 56 servers and the broader integration count describe different offerings.
• Cases and agents: Open Source includes case management, comments, attachments and custom fields, alongside agents and agent presets. Enterprise adds case tasks, metrics, triggers, correlation and other advanced case functions. Human-in-the-loop tool approvals and a unified agent inbox are also Enterprise-only, so teams requiring governed agent actions should budget for the paid tier.
• Security and support: Open Source includes SSO and organization audit logs. Enterprise adds platform audit logs, custom roles, service accounts and SCIM, as well as 24/7 Slack and email support and custom SLAs. The free edition's Discord and GitHub support suits teams comfortable with community channels, not those requiring a contracted response path.

Pricing

Tracecat uses a freemium model with two plans. Both include unlimited workflows, cases and agents, but deployment, execution terms, access controls and support differ substantially.

The free plan avoids workflow, case and agent caps, but it is self-hosted and leaves monthly execution management to the customer. Its missing approvals and advanced case functions are meaningful limits for teams standardizing agent oversight or complex investigations. Enterprise pricing is custom rather than a fixed per-seat price.

Platforms

Tracecat supports web access, an API and self-hosted deployment. Open Source can be deployed with Docker or AWS Fargate; Enterprise also lists a Kubernetes Helm chart. Managed cloud is offered, with Enterprise cloud regions in the US and EU.

Who it's for

Tracecat is aimed at AI-native security teams and focused Tier 1 and Tier 2 workflows, including phishing, suspicious OAuth grants, EDR malware alerts and cloud findings. It is a strong fit for teams that want configurable automation and can operate a self-hosted stack. Teams needing tool approvals, advanced case functions, custom roles or enterprise support should consider Enterprise; those wanting a simpler prebuilt service or unwilling to maintain automation should look elsewhere.

Pros and cons

• Pro: Open Source provides unlimited workflows, cases and agents at 0.00 USD per free, making it possible to build a substantial self-managed deployment without per-workflow caps.
• Pro: Workflow branching, parallelism and Python, Bash and Ansible scripts allow teams to shape response playbooks around their own processes.
• Pro: Case management, comments, attachments and custom fields are included in Open Source rather than reserved entirely for Enterprise.
• Con: Open Source requires self-hosting and self-managed monthly executions, putting deployment and capacity responsibilities on the team.
• Con: Human-in-the-loop tool approvals, the agent inbox and advanced case capabilities require Enterprise, limiting the free tier for teams that need governed agent actions or richer investigations.
• Con: Enterprise uses custom pricing, so teams cannot compare a fixed price before discussing their needs.

Alternatives

SOAR Software and Runbook Automation Software are useful category starting points for comparing options beyond Tracecat.

• OpenSOAR is worth considering for teams prioritizing a free, self-hosted option with no feature gates or per-action billing.
• Sumo Logic is a better alternative for readers seeking a web-based logs, metrics and traces service with a free tier of 20 daily credits, 7-day log retention and up to 3 users.
• CrowdStrike Falcon Surface is an alternative for readers specifically evaluating exposure management; its pricing requires a demo.
• Tines may suit teams looking for a web-based workflow alternative whose free edition allows 3 live workflows.
• Palo Alto Networks Cortex Cloud API Security is another paid API security option.
• Swimlane Turbine is a paid alternative for teams evaluating an enterprise automation platform with API, Linux, self-hosted and web support.
• Cyware Security Orchestration and Automation is a paid option with custom quotes that vary with deployment, seats, intelligence feeds and automation volume.
• Defensys SOAR Platform is another paid SOAR option for teams willing to request a demo.

Verdict

Choose Tracecat if your AI-native security team wants flexible, open-source automation, integrated case handling and the capacity to self-host and maintain workflows. The unlimited free tier is its clearest advantage; the deciding reason to look elsewhere or move to Enterprise is the lack of free tool approvals and advanced case capabilities.