October 30, 2026

Turbine On-Prem 26.5.1 includes new features, enhancements, and bug fixes focused on high-volume automation, a more capable Hero AI Companion, and a smoother builder experience.

This release extends Hero AI so the Hero AI Companion can call tools from registered MCP servers, and so external AI clients can call selected Turbine components through a Turbine MCP server. Application Builder now includes Build with Hero AI, so you can add or change fields, layout, and workflow from the same Hero AI Companion panel.

Scale with confidence as data volumes grow. This release introduces powerful capabilities to help teams process large datasets more efficiently, accelerate high-volume workflows, and manage vulnerability workloads at scale by introducing Performance Applications and Big Data Native Action. With faster bulk record operations, enhanced support for performance-intensive applications, and advanced data processing, organizations can streamline complex operations and scale automation to meet growing demands.

This release also makes it easier to distribute content across multiple tenants. A single content package can be deployed to multiple or all accessible tenants in one operation, eliminating the need to repeat the deployment for each tenant.

Search Records, Hero AI, and HTTP actions can retry when a first attempt is empty or hits a transient error.

Overall, Turbine 26.5.0 helps teams run larger automations more reliably and connect Hero AI to the tools they already use.

Take an interactive tour of the key features in Turbine 26.5 with the guided walk through below:

Hero AI now supports the Model Context Protocol (MCP), an open standard for connecting AI to external tools and data sources. Administrators configure and manage those connections in Turbine so the Hero AI Companion and Hero AI Native Actions can use specialized tools for lookups and follow-up actions instead of switching to another product. This capability is available for Turbine Cloud and On-Prem.

You add a remote server under External MCP Servers, enter a name and HTTPS URL, and choose authentication: No Auth, API Key, Bearer Token, or Basic Auth. You can add query parameters or extra headers when the remote server requires them. OAuth is not available in this release. On View Tools, Turbine discovers the advertised tools. Resources and prompts from the remote server are not supported. If discovery fails, you can still save the server and retry later.

MCP tools are not available in Companion until you allow them on Hero AI Companion Configuration (up to 15). Companion users can view the allowed list from the wrench in the chat header (Hero AI Context & Tools). If External MCP Servers is missing from the Administrator rail, the Host capability is not enabled for the tenant.

You can also add MCP Tools to Hero AI Native Actions. Once an External MCP Server has been added to the tenant, the tools from that server will be available to Hero AI Native Actions in the External Tools tab.

For more information, see External MCP Servers, Hero AI Companion Configuration, and Hero AI Native Action.

You can run Turbine as an MCP server so a non-Swimlane AI application or assistant can call selected tenant components as tools. Administrators create one or more servers at the tenant, choose exactly which components each server publishes, and monitor server status. Component runs that start from an MCP server are labeled in Operational Health. Authentication uses a generated URL and a Turbine personal access token in the Private-Token header. Role-based access control still applies to the published components.

Turbine generates a unique URL for the MCP Server and provides a JSON configuration snippet to paste into the client. The copied snippet includes "type": "http" so Claude Desktop and Claude CLI accept the configuration. Cursor, ChatGPT, and Gemini CLI use the same snippet. Add the snippet in Cursor under Settings, Tools & MCP, Add Custom MCP, or in a custom Claude MCP file. Replace the placeholder with your personal access token. Do not put the token in the URL. If the client supports only OAuth catalog connectors, it cannot call a Turbine MCP server in this release. Regenerating the URL invalidates any URL you already shared.

For more information, see Turbine MCP Servers.

Application Builder includes a Hero AI application builder agent so you can change an application that is already open using natural-language prompts. The agent does not create a new application. You can ask Companion to add or update fields, adjust the layout, or set up workflow rules. Select Build with Hero AI to enter Application Building Mode. The Workflow and Application builders stay on the same page, and Preview shows the record form before you save. Preview does not create a record.

Hero AI highlights modified fields and presents a change summary so you can review AI-assisted updates before you keep them. Undo and Redo remain available while you edit. This keeps drafting, preview, and review in one workspace instead of moving between a separate chat and Application Builder.

For more information, see Application Builder and Hero AI Companion.

Performance Applications are built for high-volume workloads such as vulnerability risk management, where records do not need the full Swimlane processing lifecycle (correlation, workflows, notifications, and similar processing). They store and process large data sets with less overhead so ingestion, transformation, and analytics can run at higher throughput. This capability is currently supported only for the Vulnerability Response Management (VRM) solution. It is not supported on Turbine On-Prem.

The applications list does not include a create-from-scratch Performance Application action. In Application Builder, a bolt icon and the hover text Optimized for high data volumes identify the application. Built-in fields support search and sorting. You can hide built-in fields you do not need and add custom fields; custom fields do not support search and sorting in the application.

For more information, see Application Builder and Manage Applications and Applets.

Create Record, Update/Create Record, and Delete Records now support Bulk mode so playbooks can process an array of records instead of looping one record at a time. Automation engineers can pass datasets such as arrays of objects or JSON into the native Create and Update actions, and can delete many records in one step. Use Bulk mode when the target is a Performance Application. This capability is currently only supported for the Vulnerability Response Management (VRM) solution. It is not supported on Turbine On-Prem.

On Inputs, turn on Bulk mode, map the Bulk Input Source, select the Performance Application, and map the create or update fields. Required application fields stay required; map each one from the bulk source or a playbook property. Restrictions are not supported in Bulk mode. Configure restrictions on a single-record run, or apply them outside bulk.

For more information, see Record Actions, Create Record, Update/Create Record, and Delete Records.

Canvas includes a Big Data native action for high-volume processing that a record-by-record Script or Transform Data step cannot keep up with. The action uses a distributed batch engine so playbooks can filter, normalize, enrich, or deduplicate large inputs in one optimized run instead of iterating row by row. Typical uses include vulnerability risk management and other large-file or large-array workloads. This capability is supported for the Vulnerability Response Management (VRM) solution. It is not supported on Turbine On-Prem.

Add Big Data from the native actions panel. On Inputs, add an Attachment property, then map it with Add Playbook Property or Add Expression. Write a PySpark script on Script, then map outputs on Outputs. The script environment includes the familiar Script globals plus a Spark session and helpers for CSV and JSON attachments. Use Big Data when you need batch compute. Use the Script native action for sandboxed Python on a single action run.

For more information, see Using the Big Data Native Action, Native Actions, Using the Script Native Action, and Using the Transform Data Native Action.

Turbine Library now makes it easier to distribute content across multiple tenants. A single content package can be deployed to multiple or all accessible tenants in one operation, eliminating the need to repeat the deployment for each tenant.

Users can select the target tenants, monitor deployment progress, and choose to overwrite or skip content that is already deployed. Deployment results and failures are available for follow-up, helping simplify content distribution across large multi-tenant environments.

For more information, see User Content Homepage.

Search Records and Hero AI previously ran once. In asynchronous pipelines a Search could run before the record existed and return empty results, and Hero AI could fail on a transient error. Those cases required Sleep steps or extra playbook logic.

This release exposes the existing retry framework on Search Records and Hero AI. You configure retry count, interval, and conditions in the action. Search Records retries until a record is found. Hero AI retries until the action succeeds with no error. HTTP already had retry; this release adds a preset default condition so HTTP retry works without extra setup. Retry is not added for Update/Create, Create, or Delete Record in this release.

For more information, see Search Records, Hero AI Native Action, and Using the HTTP Request Native Action.

Record Activity is now the record history for a saved record. Open it from the history control on the record. Each change shows whether it came from a user, a playbook, a widget, or a component.

A playbook or component change shows the playbook or component name. View Run opens that run while run details are available. A workflow change includes Workflow executed, which opens the workflow run. A bulk update is labeled Modified using Bulk Update. Use the date filter to limit the list. The filter opens on Today.

When Record Activity is enabled, a new, copied, or imported application includes two read-only fields, Creation source and Update source. They start in Hidden Fields. You can place them on the form or add them as report columns. Existing applications do not receive these fields until the application is copied or imported.

A CSV export shows the display name for those fields when the export includes them. A CSV import does not keep the values in those columns. Turbine sets the source from the import.

For more information, see History, Import Data, and Export Record.

This release upgrades OpenSSL to version 4.0 to maintain platform security and support. The updated version restricts certain weak cryptographic functions, which may affect existing Python scripts that rely on these functions.

Customers are encouraged to review their Python scripts and ensure they use strong, supported cryptographic algorithms for hashing and encryption, such as SHA-256, to maintain compatibility and security.

The following issues are addressed in this release.