Tracecat

Custom security agents. Build agents with prompts, tools, MCP, subagents, and skills, including VirusTotal-style tool use with approval gates.[1]

Case management. Track, automate, and resolve incidents with cases carrying agent-written verdicts, timelines, indicators, and evidence.[1]

Durable workflows. Execute deterministic automation with resilience and scale on Temporal, with reusable variables across workflows and agents.[1]

100+ integrations and hosted MCP servers. Connect 100+ pre-built security tool connectors and 50+ Tracecat-hosted MCP servers, or attach any custom MCP server over HTTP, OAuth, or local commands.[1]

Sandboxed execution. Run untrusted code and agents inside nsjail sandboxes or pid runtimes, and sync custom Python scripts from a Git repository registry.[1]

SSO and audit logs included. SAML and OIDC single sign-on carry no SSO tax, and audit logs are free and exportable into an existing SIEM.[1]

Deploy anywhere including air-gapped. Run Tracecat Cloud with US or EU hosting, or self-host with Docker, AWS Fargate, or Kubernetes down to fully air-gapped environments.[1][2]

Enterprise team controls. The paid Enterprise Edition adds multi-tenant workspaces, RBAC and ABAC with OAuth scopes, human-in-the-loop approvals via inbox, Slack, or email, Git-synced version control, and workflow metrics.[1]

Security teams replacing SOAR tooling. Teams comparing Tines or Splunk SOAR on price, self-hosting, or air-gap needs fit Tracecat's documented positioning. This fit is inferred from the official comparison, not stated as a buyer outcome.[1][2]

Teams building AI security agents. Agents, skills, MCP tooling, and human-in-the-loop approvals suit teams that want agents drafting verdicts and running tools under review. This fit is inferred from the documented agent capabilities.[1]

Operators needing disconnected deployments. Documented air-gapped Docker installs suit sensitive environments that cannot depend on a vendor cloud. This fit is inferred from the air-gap documentation.[1][2]

Enterprise features are paid and gated. Multi-tenancy, fine-grained access control, approvals, version control, and metrics sit behind the paid Enterprise Edition license, and ee-gated code must not be redistributed or used in production without permission.[1]

Self-hosting needs real infrastructure. Temporal, PostgreSQL, an S3-compatible store, and sandboxes imply operator-managed services rather than a single binary, so small teams should budget setup and upkeep. This difficulty reading is inferred from the documented stack.[1]

Pricing details were not observed. Enterprise and Cloud pricing figures did not appear on the pages reviewed, so budget planning needs a vendor quote or pricing page check.[1][2]