Tracecat Security Automation Platform
The open-source security automation platform for teams and AI agents, turning prompts into end-to-end SecOps automations.
Evidence shows nsjail sandbox by default, least-privilege CI with hash-pinned actions, and webhook ingress scoping guidance — positive. However, human-in-the-loop approval for sensitive tool calls is Enterprise-only, so open-source user confirmation is thin; data flow (sentry-sdk telemetry) is undocumented in provided files; external effects via 100+ connectors lack OSS-side consent/approval evidence; no explicit rollback mechanism is described. Hence several 1s.
pyproject, SECURITY.md and README are mutually consistent (sandbox, Temporal, deployment stack); all dependencies are exactly pinned with documented overrides — 2 for self-consistency and dependency availability. No direct evidence of failure-message quality in the provided files, so failure_messages stays at 1.
Audience and scenarios (security teams, SOC automation, self-host/cloud) are clearly and thoroughly stated — 3. Capability boundaries are disclosed ('active development', pid-runtime caveat) — 2. But trigger precision for the agent (input validation, trigger conditions) has no concrete description in the provided files — 1.
License handling is exemplary: full AGPL-3.0 text plus clearly stated EE directory exception, consistent across badge and pyproject — 3. Known limitations and maintenance signals (commit badge, supported-versions policy) earn 2. README lacks concrete install steps (delegated to docs site) and examples/FAQ point only to Discord, so those stay at 1.
Marginal value is clear for an all-in-one platform (agents + workflows + cases + tables) — 2. But output usability has no static evidence (no agent output spec/samples), and cost-benefit is degraded because key capabilities (RBAC, HITL, hosted MCP servers) are gated to Enterprise; self-host resource needs are unquantified — 1 each.
Most claims (sandboxing, stack, license) trace to concrete files like pyproject/SECURITY.md — 2. The only tests provided are frontend table utility tests, which cannot corroborate core agent/workflow claims; the '100+ connectors' figure is unverifiable within provided files — 1. Fact/inference separation is generally manageable — 2.
- This is a static source review with low confidence; no execution or sandbox-escape testing was performed.
- Key safety capabilities (HITL approval, fine-grained RBAC, hosted MCP servers) are Enterprise-only; open-source self-hosting requires compensating controls.
- nsjail is enabled by default only for Helm/Kubernetes deployments; Docker Compose and other options require explicit enabling — default configs may be riskier.
- Data flows for telemetry dependencies (sentry-sdk) are not documented in the provided files; verify outbound data before deployment.
- The pid runtime (UnsafePidExecutor) is explicitly excluded from breakout reports; avoid it in production.
- Publisher identity is unverified; verify supply-chain trust yourself via image digests and dependency locks.
What does this agent do, and when should you use it?
Tracecat (GitHub: TracecatHQ/tracecat) is an open-source security automation platform that unifies agents, low-code workflows, lookup tables, and case management. Workflows run durably on Temporal with complex control flow such as if-conditions and loops, while agents and untrusted code execute in nsjail sandboxes by default. Its Tracecat MCP turns prompts into automations via coding agents like Claude Code, Codex, and Copilot, and an MCP client connects custom agents to remote or local MCP servers. The backend is Python with FastAPI and PostgreSQL, the frontend is Next.js, and deployment is available as managed Tracecat Cloud or self-hosted via Docker, AWS Fargate, or Kubernetes Helm. The core repo is AGPL-3.0 licensed, with Enterprise Edition features (packages/tracecat-ee) under a paid license.
Users prompt from their own agent harness (e.g. Claude Code, Codex, OpenCode); Tracecat MCP converts prompts into automations composed of agents, workflows, cases, and tables. Workflows execute durably on Temporal, supporting if-conditions, loops, and custom Python scripts synced from a Git repo into the custom registry as agent tools and workflow steps. Agents invoke 100+ pre-built connectors to enterprise tools via HTTP, SMTP, gRPC, OAuth, and more, and can reach MCP servers over remote HTTP/OAuth or locally via npx/uvx commands. Case management tracks, automates, and resolves work items; lookup tables store and query structured data; audit logs export to your SIEM.
- SOC teams automating alert triage and incident response with durable execution and sandboxed agent runs.
- Teams already using coding agents (Claude Code, Codex, OpenCode) that want to generate security automations directly from prompts.
- Security teams needing a unified case management platform where agents and workflows handle work items.
- Organizations that need SAML/OIDC SSO without paying an SSO tax.
- Enterprises requiring human-in-the-loop approval of sensitive tool calls via inbox, Slack, or email.
What are this agent's strengths and limitations?
- Durable execution powered by Temporal makes workflows resilient to failures and retries, suited to long-running security automations.
- nsjail sandboxing of untrusted code and agents by default is a clear security design choice.
- 100+ pre-built connectors plus bidirectional MCP support (client and server) give broad integration coverage.
- Open-source edition includes SAML/OIDC SSO and exportable audit logs with no SSO tax.
- The project is under active development; the changelog must be reviewed before updating, implying possible breaking changes.
- AGPL-3.0 main license constrains redistribution and commercialization; the EE directory (packages/tracecat-ee) requires a paid license.
- Self-hosting requires operating multiple components: PostgreSQL, Temporal, S3-compatible object storage, Docker — a non-trivial deployment footprint.
- The README lacks concrete install commands and environment variable documentation, adding onboarding friction.
How do you install or deploy this agent?
The README does not provide step-by-step install commands; it documents deployment options only: sign up for Tracecat managed Cloud (US or EU hosting), or self-host with Docker, AWS Fargate, or Kubernetes Helm. Missing information: concrete docker compose / Helm commands, required environment variables (database, Temporal, S3, secrets), and initial account setup — consult the repository docs for these.
How do you use this agent?
After deploying or signing up, use Tracecat in three ways: (1) build workflows and manage cases in the low-code builder UI; (2) prompt from your own agent tools (Claude Code, Codex, Copilot, etc.) via Tracecat MCP to generate automations; (3) sync custom Python scripts from your Git repo into the custom registry to use as agent tools and workflow steps. Agents and untrusted code run inside nsjail sandboxes by default.