LoginSign Up
← Back to all sparks
T

Tracecat

PM
Velocity6.3

Open-source workflow automation and case management platform.

tracecat.com ↗

Tracecat 1.5 alpha patches add sub-cases and lock down agent sandboxes.

security-automationai-agentsmulti-tenancycase-managementself-hosting
◆Current state
Tracecat 1.4.0 went stable with MCP variable tools and case task actions, and 1.5.0-alpha.2 hardened multi-tenant installs with row-level security, database roles and cloud IAM logins. Four alpha.2 patches followed within a day: sub-cases close with their parent and can be used to deduplicate cases, sandboxes start isolated and cannot read loader variables, agents can use more than 50 tools, and several API errors now return proper status codes.
◆Where it's heading
The 1.5 line is about making Tracecat safe to run for many tenants and many agents at once. The patch run splits between tenant isolation fixes and case management features for handling duplicate alerts.
◆Prediction
Expect more alpha.2.x patches and then a 1.5.0 release candidate that bundles the tenant isolation work with sub-case handling.

◆Recent moves

  1. 1d ago

    1.5 alpha.2.4: sub-case actions to merge duplicate cases

    Adds workflow actions for sub-cases so duplicate alerts can be folded under one parent case. Together with the previous patch it gives Tracecat a parent and child case model for triage.

    View source ↗
  2. 1d ago

    1.5 alpha.2.3: sub-cases close with their parent

    Closing a parent case now closes its sub-cases. A small rule that prepares the sub-case actions shipped minutes later.

    View source ↗
  3. 1d ago

    1.5 alpha.2.2: agent sandboxes start isolated

    Sandbox entrypoints now start in isolated mode and cannot read loader variables. Follow-up hardening on the tenant isolation work in alpha.2.

    View source ↗
  4. 1d ago

    1.5 alpha.2.1: tenant-scoped reads, 50+ agent tools

    A fix batch: agent tier and channel reads are scoped to their tenant, agent chats can use more than 50 tools, large uploads no longer stall and API errors return proper 4xx codes. Cleanup after the heavy alpha.2 build.

    View source ↗
  5. 3d ago

    1.5 alpha.2: row-level security, IAM logins, agent session feed

    Alpha.2 is the heaviest 1.5 build so far: enforced row-level security and database roles for tenants, cloud IAM logins for Postgres and Redis, an agent session feed with retired-model migration, and new Trend Vision One, Swif and CrowdStrike actions. It shifts the 1.5 focus from fixes to making shared, self-hosted deployments safe.

    View source ↗
  6. 8d ago

    Nightly: workflow agent actions run on the selected backend

    A nightly that runs workflow agent actions on whichever agent backend is selected. Plumbing for the selectable backends introduced after 1.3.

    View source ↗