Tracecat

Tracecat is an open source SOAR platform designed for AI-native security teams. It enables building and running security agents, workflows, and cases that teams own, to automate and orchestrate security operations.

Tracecat provides a self-hosted/open source security automation platform where users create agents that ingest alerts from SIEM/EDR/CNAPP, automate workflows, and manage cases. It supports integrating with hundreds of connectors, running customizable runbooks and scripts, and enabling human-in-the-loop approvals. The platform emphasizes AI-native agents, hosted MCP server connections, and the ability to map real alerts into actionable cases and containment actions across a connected security stack.

Who it’s for: Security operations teams at organizations using AI-native approaches and prefer open source, self-hosted security automation with programmable agents and runbooks.

Mentions self-hosted/open source model, hosted MCP servers, and enterprise-style security agent workflows; shows active product usage in demos and customer-like workflows but no named paying customers listed.