Turbine 26.5.0 includes new features, enhancements, and bug fixes focused on high-volume automation, a more capable Hero AI Companion, and a smoother builder experience.

This release extends Hero AI so Companion can call tools from registered MCP servers, and so external AI clients can call selected Turbine components through a Turbine MCP server. Application Builder now includes Build with Hero AI, so you can add or change fields, layout, and workflow from the same Companion panel.

The release also improves scale for large data sets. Performance Applications, Bulk mode for Create Record, Update/Create Record, and Delete Records, and the Big Data native action are supported for the Vulnerability Response Management (VRM) solution. These capabilities are not supported on Turbine On-Prem. Performance Applications support high-volume workloads such as vulnerability management. Create Record, Update/Create Record, and Delete Records can run in bulk. Canvas includes a Big Data native action so playbooks can run PySpark on mapped file attachments.

This release also makes it easier to distribute content across multiple tenants. A single content package can be deployed to multiple or all accessible tenants in one operation, eliminating the need to repeat the deployment for each tenant.

Search Records, Hero AI, and HTTP actions can retry when a first attempt is empty or hits a transient error.

Overall, Turbine 26.5.0 helps teams run larger automations more reliably and connect Hero AI to the tools they already use.

Hero AI now supports the Model Context Protocol (MCP), an open standard for connecting AI to external tools and data sources. Administrators configure and manage those connections in Turbine so Companion can use specialized tools for lookups and follow-up actions instead of switching to another product. This capability is available for Turbine Cloud and On-Prem.

You add a remote server under External MCP Servers, enter a name and HTTPS URL, and choose authentication: No Auth, API Key, Bearer Token, or Basic Auth. You can add query parameters or extra headers when the remote server requires them. OAuth is not available in this release. On View Tools, Turbine discovers the advertised tools. Resources and prompts from the remote server are not supported. If discovery fails, you can still save the server and retry later.

Discovered tools are not available in Companion until you allow them on Hero AI Companion Configuration (up to 15). Companion users open the allowed list from the wrench in the chat header (Hero AI Context & Tools). If External MCP Servers is missing from the Administrator rail, the Host capability is not enabled for the tenant.

You can run Turbine as an MCP server so a non-Swimlane AI application or assistant can call selected tenant components as tools. Administrators create one or more servers at the tenant, choose exactly which components each server publishes, and monitor server status. Component runs that start from an MCP server are labeled in Operational Health. Authentication uses a generated URL and a Turbine personal access token in the Private-Token header. Role-based access control still applies to the published components.

You do not type the URL. Turbine generates it and provides a JSON configuration snippet to paste into the client. The copied snippet includes "type": "http" so Claude Desktop and Claude CLI accept the configuration. Cursor, ChatGPT, and Gemini CLI use the same snippet. Swimlane is not listed in public MCP connector catalogs. Add the snippet in Cursor under Settings, Tools & MCP, Add Custom MCP, or in a custom Claude MCP file. Replace the placeholder with your personal access token. Do not put the token in the URL. If the client supports only OAuth catalog connectors, it cannot call a Turbine MCP server in this release. Regenerating the URL invalidates any URL you already shared.

Application Builder includes a Hero AI application builder agent so you can change an application that is already open using natural-language prompts. The agent does not create a new application. You can ask Companion to add or update fields, adjust the layout, or set up workflow rules. Select Build with Hero AI to enter Application Building Mode. The Workflow and Application builders stay on the same page, and Preview shows the record form before you save. Preview does not create a record.

Hero AI highlights modified fields and presents a change summary so you can review AI-assisted updates before you keep them. Undo and Redo remain available while you edit. This keeps drafting, preview, and review in one workspace instead of moving between a separate chat and Application Builder.

Performance Applications are built for high-volume workloads such as vulnerability risk management, where records do not need the full Swimlane processing lifecycle (correlation, workflows, notifications, and similar processing). They store and process large data sets with less overhead so ingestion, transformation, and analytics can run at higher throughput. This capability is supported for the Vulnerability Response Management (VRM) solution. It is not supported on Turbine On-Prem.

You create a Performance Application by importing a package from the Swimlane Solution Provider or Marketplace. The applications list does not include a create-from-scratch Performance Application action. In Application Builder, a bolt icon and the hover text Optimized for high data volumes identify the application. Built-in fields support search and sorting. You can hide built-in fields you do not need and add custom fields; custom fields do not support search and sorting in the application.

Note: Performance Applications are behind a feature flag and must be enabled; to enable this feature, contact Swimlane Support.

Create Record, Update/Create Record, and Delete Records now support Bulk mode so playbooks can process an array of records instead of looping one record at a time. Automation engineers can pass datasets such as arrays of objects or JSON into the native Create and Update actions, and can delete many records in one step. Use Bulk mode when the target is a Performance Application. This capability is supported for the Vulnerability Response Management (VRM) solution. It is not supported on Turbine On-Prem.

On Inputs, turn on Bulk mode, map the Bulk Input Source, select the Performance Application, and map the create or update fields. Required application fields stay required; map each one from the bulk source or a playbook property. Restrictions are not supported in Bulk mode. Configure restrictions on a single-record run, or apply them outside bulk.

Note: Bulk mode is behind a feature flag and must be enabled; to enable this feature, contact Swimlane Support.

Canvas includes a Big Data native action for high-volume processing that a record-by-record Script or Transform Data step cannot keep up with. The action uses a distributed batch engine so playbooks can filter, normalize, enrich, or deduplicate large inputs in one optimized run instead of iterating row by row. Typical uses include vulnerability risk management and other large-file or large-array workloads. This capability is supported for the Vulnerability Response Management (VRM) solution. It is not supported on Turbine On-Prem.

Add Big Data from the native actions panel. On Inputs, add an Attachment property, then map it with Add Playbook Property or Add Expression. Write a PySpark script on Script, then map outputs on Outputs. The script environment includes the familiar Script globals plus a Spark session and helpers for CSV and JSON attachments. Use Big Data when you need batch compute. Use the Script native action for sandboxed Python on a single action run.

Note: The Big Data native action is behind a feature flag and must be enabled; to enable this feature, contact Swimlane Support.

Turbine Library now makes it easier to distribute content across multiple tenants. A single content package can be deployed to multiple or all accessible tenants in one operation, eliminating the need to repeat the deployment for each tenant.

Users can select the target tenants, monitor deployment progress, and choose to overwrite or skip content that is already deployed. Deployment results and failures are available for follow-up, helping simplify content distribution across large multi-tenant environments.

Search Records and Hero AI previously ran once. In asynchronous pipelines a Search could run before the record existed and return empty results, and Hero AI could fail on a transient error. Those cases required Sleep steps or extra playbook logic.

This release exposes the existing retry framework on Search Records and Hero AI. You configure retry count, interval, and conditions in the action. Search Records retries until a record is found. Hero AI retries until the action succeeds with no error. HTTP already had retry; this release adds a preset default condition so HTTP retry works without extra setup. Retry is not added for Update/Create, Create, or Delete Record in this release.

The Activity feed is now the default record history. It provides a centralized audit trail for record updates from manual edits, playbook actions, widgets or API calls, and background workflows, with each change attributed to its source.

Related playbook and workflow activity can group together and show metadata such as playbook name, run ID, and action ID so you can open the execution that produced the change. Field changes include updates that were previously omitted, such as restricted fields. Commit-style summaries and chronological filtering support troubleshooting and enterprise compliance review.

OpenSSL in Swimlane Turbine is upgraded to OpenSSL 4.0. This upgrade limits some weak cryptographic functions. It is recommended that you use SHA-256 in your scripts instead of MD5 or SHA-1.

The following issues are addressed in this release.