- Agents
- Workflows
- Tables (local and remote)
- Integrations (HTTP, gRPC, SQL)
- Scripts (Python, docker run)
- Cases (local and remote)
Installation
Claude Code
OpenAI CodexCursor
Copy
Ask AI
claude mcp add -t http tracecat https://platform.tracecat.com/mcp
claude
/mcp
Copy
Ask AI
codex mcp add tracecat --url https://platform.tracecat.com/mcp
codex mcp login tracecat
Click this link Add Tracecat to Cursor
Or manually configure in
.cursor/mcp.json:Copy
Ask AI
{
"mcpServers": {
"tracecat": {
"url": "https://platform.tracecat.com/mcp"
}
}
}
Starter prompts
Recreate automation from blog post
Audit and improve existing workflows
Build alert triage automation
Automate phishing email response
MCP tools
Show Tools
Show Tools
List all workspaces accessible to the authenticated user.Returns a JSON array of workspace objects with id, name, and role.
Show Tools
Show Tools
Create a new workflow in a workspace.
Get metadata for a specific workflow.
Export a workflow to a staged download URL.
Prepare a staged workflow file upload for remote
/mcp clients.Clients typically save and upload files locally before handing them to the remote MCP upload URL returned by this tool.Create a workflow from a previously staged workflow file upload.
Update a workflow from a previously staged workflow file upload.
Update workflow metadata and optional inline YAML.
List workflows in a workspace.
List workflow folders and workflows under a path.
Create a workflow folder by absolute path.
Move workflows into or out of a folder.This tool is best-effort and non-atomic. If one workflow fails to move, the remaining workflow moves still proceed.
Search or browse available actions and return compact context metadata.Supports three usage modes:
-> Search: provide
query to search by name/description across all namespaces. Example: list_actions(workspace_id, query=“send message”)
-> Browse namespace: provide namespace without query to list all actions in a namespace. Example: list_actions(workspace_id, namespace=“tools.slack”)
-> Browse all: omit both to list all available actions.Common namespaces: core, tools.slack, tools.crowdstrike, tools.okta, ai.Get full schema and configuration context for a single action.Use this after discovering an action via
list_actions to get the complete parameter schema needed to write the args: block in a workflow definition.Example action names: “core.http_request”, “tools.slack.post_message”, “core.script.run_python”, “core.transform.reshape”.Get compact workflow authoring context for selected actions.Returns everything needed to write a workflow definition: action schemas, available secrets, and workspace variables. Use this before calling
create_workflow or update_workflow.Two input modes (provide one or neither):
-> By name: pass action_names_json as a JSON array of action names, e.g. ’[“core.http_request”, “tools.slack.post_message”]’
-> By search: pass query to search for actions by name/descriptionValidate a workflow’s draft state.Checks that the workflow DSL is structurally sound and that arguments are valid.
Prepare a staged template YAML upload for remote
/mcp clients.Validate a template action YAML file.Validates YAML parsing, template schema correctness, step action references, argument schemas, and expression references.
Publish (commit) a workflow, creating a new versioned definition.This validates the workflow, freezes registry dependencies, and creates a new workflow definition version.
Run a workflow from its current draft state (without publishing).Optionally update the workflow’s title/description before running.
Run the latest published version of a workflow.The workflow must have been published (committed) at least once.
List recent executions for a workflow.Use this to see run history, check which runs succeeded or failed, and find execution IDs for deeper inspection with get_workflow_execution.
Get status and details of a specific workflow execution.Returns execution metadata (status, timing) and a compact event timeline showing each action’s status, timing, and any errors. Use this to debug failed runs or check the progress of running workflows.
Get webhook configuration for a workflow.
Update webhook configuration for a workflow.
Get case trigger configuration for a workflow.
Update an existing case trigger for a workflow.
List workflow tag definitions in a workspace.Returns a JSON array of tag objects with
id, name, ref, and color.Create a workflow tag definition.
Update a workflow tag definition.
Delete a workflow tag definition.
List tags attached to a workflow.Returns a JSON array of tag objects with
id, name, ref, and color.Attach an existing workflow tag definition to a workflow.
Remove a workflow tag association from a workflow.
Show Tools
Show Tools
List case tag definitions in a workspace.Returns a JSON array of tag objects with
id, name, ref, and color.Create a case tag definition.
Update a case tag definition.
Delete a case tag definition.
List tags attached to a case.Returns a JSON array of tag objects with
id, name, ref, and color.Attach a case tag to a case.
Remove a case tag association from a case.
List case field definitions in a workspace.Returns a JSON array of field objects with
id, type, description, nullable, default, reserved, and options.Create a case field definition.
Update a case field definition.
Delete a case field definition.
Show Tools
Show Tools
List workspace tables.
Create a table with optional columns.
Get table definition and index metadata.
Update table metadata.
Insert a table row.
Update a table row.
Search rows in a table.
Export table data as a staged download URL.
Show Tools
Show Tools
List workspace integrations useful for workflow and preset authoring.
Show Tools
Show Tools
Get models, integrations, output_type guidance, and other preset authoring context.
Create an agent preset in the selected workspace.
List saved agent preset slugs and names.Use
get_agent_preset for the full preset definition.Run an agent preset with a prompt and return text or approval status.Creates an ephemeral session, triggers the agent workflow, and waits for the response. The agent has access to all tools configured on the preset.