LoginSign Up
← Back to all sparks
T

Tracecat

PM
Velocity6.3

Open-source workflow automation and case management platform.

tracecat.com ↗

Tracecat is drawing hard boundaries around what its agents are allowed to touch

security-automationai-agentsmcptrust-boundariesrelease-candidates
◆Current state
Six release candidates in two weeks on the 1.0.0-beta.51 line. The agent surface is where most work lands: batch approvals, a Mistral provider, catalog IDs for custom models, interactive turns prioritised on a shared queue, and streaming status for pending approvals. Running alongside it is a steady tightening of the execution boundary — nested action execution constrained, run_python excluded from agent tools, inbound auth no longer forwarded to user MCP servers, and the Action Gateway made mandatory as an explicit breaking change.
◆Where it's heading
This is a security automation platform working out how much autonomy to hand an agent and where the trust boundary sits. The pattern across candidates is capability and constraint arriving together: each new agent affordance comes with a narrowing of what agents can reach. Integration work on SentinelOne, Okta SAML, Google SecOps and MCP connections fills the rest.
◆Prediction
Expect the beta.51 candidate run to converge toward a 1.0.0 release with the Action Gateway as the single enforced execution path, and further constraints on agent tool access as more MCP servers are connected.

◆Recent moves

  1. 1d ago

    Nested execution constrained and MCP auth forwarding stopped

    Constrains nested action execution, stops forwarding inbound auth to user MCP servers, and excludes run_python from agent tools while adding MCP resource content blocks. The clearest single statement of where the agent trust boundary now sits.

    View source ↗
  2. 6d ago

    Batch agent approvals and a Mistral provider

    Adds batch approvals for agent actions, a Mistral provider and catalog IDs for custom models, plus batch case update and delete endpoints. Approval batching is what makes human-in-the-loop workflows survive volume.

    View source ↗
  3. 9d ago

    OAuth refresh locking and MCP resource overrides

    Takes a row lock during OAuth refresh, allows an optional oauth_resource override for MCP, pins stdio catalog integrations and fixes Okta SAML audience restriction. Integration reliability work under the agent surface.

    View source ↗
  4. 13d ago

    Action Gateway becomes mandatory

    ⚡ SPARK

    Makes the Action Gateway mandatory as an explicit breaking change, alongside SentinelOne alert lifecycle actions and prioritised interactive turns on the agent queue. It forces every action through one enforcement point, which is the architectural decision the rest of this window builds on.

    View source ↗
  5. 16d ago

    Model catalog additions and stdio MCP connection tests

    Adds platform catalog models and tests for stdio MCP connections, plus an API reference reorganisation. Small additions between the heavier candidates.

    View source ↗
  6. 16d ago

    Subagent input alignment and table dialog fixes

    Removes a duplicate token remint, aligns subagent tool input with execution, and fixes several table and bulk delete behaviours. Cleanup within the candidate run.

    View source ↗