Open source SOAR and agent builder for AI-native security teams

We made the SOAR free and open source for builders.
So enterprise security teams can focus on scaling with agents.

Deploy open source

Workspace

New task

Suggestions

Workspace

Workflows

Cases

Agents

Skills

Tools

Tables

Members

Variables

Integrations

Revoke risky Google OAuth grant

We've got 3 newly-consented apps with sensitive scopes — triage them.

• Found 3 grants in last 24h via Google Admin SDK

• Cross-checking app reputation and publisher verification

Two of three grants request gmail.readonly from unverified publishers. Recommend revoking and notifying the owners.

Flagged grants

slack-notes-exportgmail.readonlygranted by a.chen@ · unverified publisher

meeting-mategmail.readonlycalendar.eventsgranted by j.lee@ · unverified publisher

pdf-merge-prodrive.metadata.readonlylow risk — allowlist suggested

Ready to revoke slack-notes-export and meeting-mate. Approve to proceed.

New OAuth grant

google.directory.consent

OAuth analyst agent

google.directory · entra.graph

Revoke grant

google.revoke_token

⌘N⌘Y

Tracecat is a cheat code for corporate security teams that want to build and own their own agentic future.

Principal Threat Researcher

Trusted by security builders replacing legacy SOAR

Workflows can't keep up. Agents can.

Self-host the SOAR primitives for free. Upgrade to Enterprise for the agent stack, hosted MCP servers, and AI governance features.

Trigger

OAuth grant

Scatter

Per user

Run subflow

Quarantine

Open source

Workflows

Visual playbook canvas. Branch, scatter, loop, and run Python actions.

alertsSIEM detection history

Active

endpoint_inventoryFalcon host inventory

Active

cloud_findingsWiz CNAPP findings

Active

oauth_grantsIdentity consents

Active

Open source

Tables

Lookup tables for IoCs, assets, and allowlists. Query from workflows and agents.

CASE-234966In progress

Shai-Hulud npm worm across 3 endpoints

High Sev 1supply chainendpoint

Open source

Cases

Triage alerts with custom fields, SLAs, comments, and two-way ticket sync.

Phishing triage agent

Opus 4.5

triage_phishing_email

enrich_alert_with_falcon

isolate_host

Enterprise edition

Agents with skills

Compose agents from reusable skills your team ships to Git.

Enterprise edition

Hosted MCP servers

50+ pre-built MCP servers for security and IT tools.

IR agentappjust now

Found 3 hosts on Shai-Hulud. Quarantine WS-042 and rotate npm tokens?

Enterprise edition

Chat in Slack and Teams

Deploy agents where your team works.

Replace click-and-drag with prompt to workflows.

Define playbooks in natural language. Give everyone the power to automate security work through Tracecat MCP.

Claude Code

ChatGPT

Microsoft Copilot

Tracecat MCP

Works with your favorite coding assistant

Everything you need to make security agents work.

Create Agent＋Add MCP Server＋Build Skill＋Open Case

Automate security work with prompts

Draft workflows, cases, tables, agent skills, and tool integrations from Claude, Cursor, or your AI workspace.

triage_phishing_email

enrich_alert_with_falcon

isolate_host

revoke_oauth_grant

open_case

page_oncall

Skills built by your team

Reusable agent capabilities your engineers ship to GitHub. Analysts compose them into runbooks.

Hosted MCP servers

Connect agents to over 100 pre-built MCP servers without writing integration code.

On-prem Your VPC Tracecat cloud

Self-host anywhere

Deploy in your own VPC, on-prem, or on Tracecat's cloud. Your prompts and detections stay yours.

Pending approval

Quarantine WS-091 in Falcon

Endpoint response agent · 12s ago

Human approvals on sensitive actions

Pause workflows for explicit approval before sensitive actions. Every approval is logged.

TODAY

Endpoint response agent quarantined WS-091

Phishing triage agent revoked 3 Okta sessions

WEDNESDAY

Cloud agent applied STS deny on prod-deployer-role

OAuth review agent staged revoke for 14 users

Audit every tool call

Open source audit logs of every prompt, tool call, and decision your agents make. In your Git, in your VPC.

Code when it matters.

Build integrations through prompts and code for any internal or third-party API.

Prompt versioning

Diff, review, and roll back every change to agent prompts and skills, with full audit history.

phishing-triage.md

a1b2c3

19Triage user emails.

20Parse headers and detonate links.

21-Use Falcon to look up the user.

21+Use Falcon to look up activity.

22+If credentials entered, revoke Okta.

23+Quarantine the host in Falcon.

24+Page the on-call responder.

Approved by @alex

Sync everything to Git

Push and pull prompts, workflows, and skills between Tracecat and your Git repo.

security-automation

main

Updatedphishing-triage.md2 min ago

Syncedcloud-enrich.yaml18 min ago

Createdisolate_host.py1 h ago

Branchedinvestigate-okta3 h ago

Mergedrotate-aws-keysyesterday

Custom Python and dependencies

Write Python actions and pin dependencies, then sync the package directly into Tracecat for agents and workflows.

1from tracecat_registry import RegistrySecret, registry

3urlscan = RegistrySecret(name="urlscan", keys=["URLSCAN_API_KEY"])

5@registry.register(

6 default_title="Look up URL",

7 namespace="tools.urlscan",

8 secrets=[urlscan],

10async def lookup_url(url: str) -> dict:

11 return await client.post(

12 "https://urlscan.io/api/v1/scan/",

13 json={url: url})

ruffmypy

Open source SOAR and agent builder for AI-native security teams

We made the SOAR free and open source for builders.
So enterprise security teams can focus on scaling with agents.

Workflows can't keep up. Agents can.

Replace click-and-drag with prompt to workflows.

Everything you need to make security agents work.

Code when it matters.

Talk to a Tracecat expert

Loved by security teams building with AI

Open source SOAR and agent builder for AI-native security teams

We made the SOAR free and open source for builders.So enterprise security teams can focus on scaling with agents.

Workflows can't keep up. Agents can.

Replace click-and-drag with prompt to workflows.

Everything you need to make security agents work.

Code when it matters.

Talk to a Tracecat expert

Loved by security teams building with AI

We made the SOAR free and open source for builders.
So enterprise security teams can focus on scaling with agents.