What is Tracecat used for?

Tracecat is a security automation platform, open source, in which security teams and AI agents build workflows, handle cases and automate incident response. It is a good fit for security alert triage automation, incident response case handling and building SOAR-style playbooks.

Is Tracecat open source?

Yes. Tracecat is open source under the AGPL-3.0 licence. Its source code is on GitHub at TracecatHQ/tracecat and is written mainly in Python.

Yes. Tracecat is open source, so the software itself is free to use. A managed cloud version is also available.

Can I self-host Tracecat?

Yes. Tracecat can be self-hosted on your own server or infrastructure.

What is Tracecat an alternative to?

Tracecat is an open-source alternative to Tines, Torq, Swimlane and Microsoft Sentinel. Other open-source alternatives to Tines include StackStorm and n8n.

Is Tracecat actively maintained?

Yes. The most recent commit to Tracecat was on 2 October 2026, and the latest release is 1.0.1, published on 18 September 2026. The project has 3.8k stars on GitHub.

Tracecat: open-source alternative to Tines, Torq, Swimlane

About Tracecat

Tracecat is open-source software for automating security operations, used by teams and AI agents together. It aims to give security teams everything they need to build agents and automate cyber defense in one place, from alert handling to incident response, with unlimited agents, cases, lookup tables and workflows.

Its building blocks include agents and skills built from prompts, tools and MCP, case management for tracking and resolving incidents with agent help, workflows that execute deterministic logic with resilience on Temporal, tables for storing and querying structured data, and a Tracecat MCP that turns prompts into automations from Claude Code, Codex and similar tools. The stack is Python with FastAPI and a Next.js interface.

Tracecat is licensed under AGPL-3.0 and can be self-hosted, with a managed cloud also offered by the vendor. It suits security operations, detection engineering and incident response teams that want a programmable, AI-ready alternative to proprietary SOAR tools.

Key features

AI agents with prompts, tools and MCP
Case management for incidents
Workflows running on Temporal
Tables for structured data lookups
Tracecat MCP for prompt-driven automation
Unlimited agents, cases and workflows

Good fit for

→Security alert triage automation
→Incident response case handling
→Building SOAR-style playbooks

Built with: Python; FastAPI; Next.js
Tags: security-automation; soar; incident-response; ai-agents; case-management; workflows; temporal; python

Tracecat: questions and answers

What is Tracecat used for?: Tracecat is a security automation platform, open source, in which security teams and AI agents build workflows, handle cases and automate incident response. It is a good fit for security alert triage automation, incident response case handling and building SOAR-style playbooks.
Is Tracecat open source?: Yes. Tracecat is open source under the AGPL-3.0 licence. Its source code is on GitHub at TracecatHQ/tracecat and is written mainly in Python.
Is Tracecat free?: Yes. Tracecat is open source, so the software itself is free to use. A managed cloud version is also available.
Can I self-host Tracecat?: Yes. Tracecat can be self-hosted on your own server or infrastructure.
What is Tracecat an alternative to?: Tracecat is an open-source alternative to Tines, Torq, Swimlane and Microsoft Sentinel. Other open-source alternatives to Tines include StackStorm and n8n.
Is Tracecat actively maintained?: Yes. The most recent commit to Tracecat was on 2 October 2026, and the latest release is 1.0.1, published on 18 September 2026. The project has 3.8k stars on GitHub.