Plaky vs Tracecat

Tracecat shipped its 1.0.0 stable release on September 16, closing out a dense two-week sprint through four release candidates. The platform now supports self-hosted LLM providers — Ollama, vLLM, LiteLLM, OpenRouter — alongside API-based models, making air-gapped deployment a first-class scenario. A parallel security hardening push blocked SSRF in MCP and custom LLM requests, tightened nsjail sandbox handoffs, and patched polynomial regex vulnerabilities. Workspace entitlements for multi-tenant deployments add the licensing structure enterprise buyers require.

Tracecat is converging on a full agentic SOAR platform: skills now grant tools to agents, case-agent interactions are tracked with mutation provenance, and version history lets investigators restore prior case states. The open-sourcing of presets, skills, and the MCP catalog points toward a community-driven integration ecosystem rather than a proprietary connector library. The drop of pydantic-ai in favor of an internal runtime, combined with end-to-end OpenTelemetry instrumentation, shows infrastructure hardening for production incident response workloads, not just demos. Integration additions across Databricks, Snowflake, Microsoft Graph, and Google Chronicle are expanding the addressable security stack.

The most likely next move is enforcement of workspace entitlements — the billing scaffold shipped in 1.0.0 but enforcement behavior is nascent — and an expansion of the MCP catalog through community submissions now that the catalog source is open.