tracecat

Why we included this project

Tracecat is aimed at security teams who spend their days triaging the same alerts over and over. It bundles agents, low-code workflows, and case management into one platform, so an analyst can build a response playbook that pulls an alert, enriches it, and hands the outcome to the right person without leaving the tool. The unusual part is the agent harness: describe the automation you want in plain language, generate it through Claude Code, Codex, or another MCP-enabled harness, then review and run it as a durable workflow on Temporal. Code runs sandboxed with nsjail by default, which matters when an agent is executing untrusted code or touching live systems. If your team cannot send credentials to a hosted cloud, Tracecat self-hosts on Docker, Fargate, or Helm, and the 100-plus prebuilt connectors cover most of the enterprise SaaS tools a security shop already runs.