Tracecat works best with agentic coding tools (Claude Code, Cursor, Codex, OpenCode). Agents connected to Tracecat MCP gain the ability to build and orchestrate core Tracecat resources:Documentation Index
Fetch the complete documentation index at: https://docs.tracecat.com/llms.txt
Use this file to discover all available pages before exploring further.
- Agents
- Workflows
- Tables (local and remote)
- Integrations (HTTP, gRPC, SQL)
- Scripts (Python, docker run)
- Cases (local and remote)
Self-hosted
MCP authentication uses a built-in OIDC provider. Your agent will be redirected to sign in through the browser on first connection. Replace<your-tracecat-url> with your PUBLIC_APP_URL (e.g. http://localhost or https://tracecat.example.com).
Claude Code
OpenAI CodexGitHub Copilot
Cursor
claude mcp add -t http tracecat <your-tracecat-url>/mcp
claude
/mcp
codex mcp add tracecat --url <your-tracecat-url>/mcp
codex mcp login tracecat
copilot
/mcp add
# Server Name: tracecat
# Server Type: HTTP
# URL: <your-tracecat-url>/mcp
# Tools: *
~/.copilot/mcp-config.json:{
"mcpServers": {
"tracecat": {
"type": "http",
"url": "<your-tracecat-url>/mcp",
"tools": ["*"]
}
}
}
Configure in
.cursor/mcp.json:{
"mcpServers": {
"tracecat": {
"url": "<your-tracecat-url>/mcp"
}
}
}
Cloud
Subscription required- OpenAI Codex
claude mcp add -t http tracecat https://platform.tracecat.com/mcp
claude
/mcp
codex mcp add tracecat --url https://platform.tracecat.com/mcp
codex mcp login tracecat
copilot
/mcp add
# Server Name: tracecat
# Server Type: HTTP
# URL: https://platform.tracecat.com/mcp
# Tools: *
~/.copilot/mcp-config.json:{
"mcpServers": {
"tracecat": {
"type": "http",
"url": "https://platform.tracecat.com/mcp",
"tools": ["*"]
}
}
}
Click this link Add Tracecat to Cursor
Or manually configure in
.cursor/mcp.json:{
"mcpServers": {
"tracecat": {
"url": "https://platform.tracecat.com/mcp"
}
}
}
Starter prompts
Recreate automation from blog post
Audit and improve existing workflows
Build alert triage automation
Automate phishing email response
MCP tools
Show Tools
Show Tools
List all workspaces accessible to the authenticated user.Returns a JSON array of workspace objects with id, name, and role.
Show Tools
Show Tools
Create a new workflow in a workspace.
Get metadata for a specific workflow.
Edit a draft workflow using RFC 6902 JSON Patch.
Export a workflow to a staged download URL.
Prepare a staged workflow file upload for remote
/mcp clients.Clients typically save and upload files locally before handing them to the remote MCP upload URL returned by this tool.Create a workflow from a previously staged workflow file upload.
Update a workflow from a previously staged workflow file upload.
Update workflow metadata and optional inline YAML.
List workflows in a workspace.
List workflow folders and workflows under a path.
Create a workflow folder by absolute path.
Move workflows into or out of a folder.This tool is best-effort and non-atomic. If one workflow fails to move, the remaining workflow moves still proceed.
Search or browse available actions and return compact context metadata.Supports three usage modes:
-> Search: provide
query to search by name/description across all namespaces. Example: list_actions(workspace_id, query=“send message”)
-> Browse namespace: provide namespace without query to list all actions in a namespace. Example: list_actions(workspace_id, namespace=“core”)
-> Browse all: omit both to list all available actions.Common namespaces: core, tools, ai.Sync the organization’s custom action registry from its remote git repository.Pulls the latest code from the custom registry repo registered in the caller’s organization, builds a versioned tarball, and makes the synced actions available to agents and workflows. Use this after pushing changes to the custom integrations repo, or to roll forward/back to a specific commit. Existing published workflows must be republished to pick up newly synced action versions.
Get full schema and configuration context for a single action.Use this after discovering an action via
list_actions to get the complete parameter schema needed to write the args: block in a workflow definition.Example action names: “core.http_request”, “core.script.run_python”, “core.transform.reshape”.Get compact workflow authoring context for selected actions.Returns everything needed to write a workflow definition: action schemas, available secrets, and workspace variables. Use this before calling
create_workflow or update_workflow.Two input modes (provide one or neither):
-> By name: pass actions with an action_names list.
-> By search: pass query to search for actions by name/descriptionValidate a workflow’s draft state.Checks that the workflow DSL is structurally sound and that arguments are valid.
Prepare a staged template YAML upload for remote
/mcp clients.Validate a template action YAML file.Validates YAML parsing, template schema correctness, step action references, argument schemas, and expression references.
Publish (commit) a workflow, creating a new versioned definition.This validates the workflow, freezes registry dependencies, and creates a new workflow definition version.
Run a workflow from its current draft state (without publishing).Optionally update the workflow’s title/description before running.
Run the latest published version of a workflow.The workflow must have been published (committed) at least once.
List recent executions for a workflow.Use this to see run history, check which runs succeeded or failed, and find execution IDs for deeper inspection with get_workflow_execution.
Get status and details of a specific workflow execution.Returns execution metadata (status, timing) and a compact event timeline showing each action’s status, timing, and any errors. Use this to debug failed runs or check the progress of running workflows.
Get webhook configuration for a workflow.
Update webhook configuration for a workflow.
Get case trigger configuration for a workflow.
Update an existing case trigger for a workflow.
List workflow tag definitions in a workspace.Returns a JSON array of tag objects with
id, name, ref, and color.Create a workflow tag definition.
Update a workflow tag definition.
Delete a workflow tag definition.
List tags attached to a workflow.Returns a JSON array of tag objects with
id, name, ref, and color.Attach an existing workflow tag definition to a workflow.
Remove a workflow tag association from a workflow.
Show Tools
Show Tools
List cases in a workspace with default sorting.
Search cases with filtering and sorting.
Get a specific case with full details including fields, tags, and description.
Create a new case.
Update a case. Only provided fields are changed.
Delete a case.
List all comments for a case.
List comment threads for a case. Each thread contains the root comment and its replies.
Create a new comment on a case. Provide
parent_id to reply to an existing comment.Update an existing comment on a case.
Delete a comment from a case.
List all tasks for a case.
Get a specific case task by ID.
Create a new task on a case.
Update a case task. Only provided fields are changed.
Delete a case task.
Run the workflow associated with a case task.Fetches the task’s
workflow_id and default_trigger_values, merges them with case_id and task_id context (plus any caller-supplied overrides), then executes the latest published version of the workflow.List activity events for a case. Events are system-generated audit entries that track every change to a case — status changes, priority changes, assignee changes, comments, tasks, tags, field changes, etc.
List case tag definitions in a workspace.Returns a JSON array of tag objects with
id, name, ref, and color.Create a case tag definition.
Update a case tag definition.
Delete a case tag definition.
List tags attached to a case.Returns a JSON array of tag objects with
id, name, ref, and color.Attach a case tag to a case.
Remove a case tag association from a case.
List case field definitions in a workspace.Returns a JSON array of field objects with
id, type, description, nullable, default, reserved, options, and optional kind.Create a case field definition.Supports optional create-only
kind: LONG_TEXT requires type="TEXT" and URL requires type="JSONB".Update a case field definition.
Delete a case field definition.
Show Tools
Show Tools
List workspace tables.
Create a table with optional columns.
Get table definition and index metadata.
Update table metadata.
Insert a table row.
Update a table row.
Search rows in a table.
Export table data as a staged download URL.
Show Tools
Show Tools
List workspace integrations useful for workflow and preset authoring.
Show Tools
Show Tools
Get models, integrations, output_type guidance, and other preset authoring context.
Create an agent preset in the selected workspace.
Update an existing agent preset in the selected workspace.
Upload a local skill directory into Tracecat as a workspace skill.Agents should read the local directory themselves, preserve relative paths, include the root
SKILL.md file, and pass every file in files using content_base64.List saved agent preset slugs and names.Use
get_agent_preset for the full preset definition.Get the full configuration for a saved agent preset by slug.
Run an agent preset with a prompt and return text or approval status.Creates an ephemeral session, triggers the agent workflow, and waits for the response. The agent has access to all tools configured on the preset.