Tines
Also known as: Tines Workbench, Tines Storyboard
Workflow and AI orchestration platform where security and IT teams build stories with AI Agent actions or import them from a prebuilt library, with Workbench confirmation before changes, bring your own model, an API and MCP server, and self hosting.
Tines is a workflow and AI orchestration platform for security and IT teams. Teams build stories, automated workflows made of actions (webhooks, inbound email, HTTP requests to any API, conditions, event transforms, Send to Story and AI Agent actions), and can import prebuilt stories from a public library that includes AI agent templates such as Azure Sentinel incident triage and IOC lookups over Slack. Workbench is an AI chat interface that runs stories as tools against the customer's own data and systems, loads Cases, keeps searchable chat history, and asks the user to confirm before any template that may change the environment runs. Any story can be set to require confirmation.
Every action emits events recording each step, and all Workbench actions and data changes go to audit logs. AI features run on Anthropic's Claude through AWS Bedrock by default, and customers can bring their own AI provider. Tines offers an API, Terraform support and an MCP server that lets outside AI clients read, build, validate and run stories. It is available as a hosted cloud service or self hosted on AWS, Azure, Google Cloud, Kubernetes, OpenShift or VMware. SSO/SAML comes on all plans, with teams for access separation, and Tines maintains SOC 2 Type II. A free edition includes three live workflows and a one time AI allowance.
Vendor details
Canonical URL
https://www.tines.com
Category
Security / SOC agent
Funding status
Independent, co-headquartered in Dublin and Boston. Tines launched Workbench in 2024 and AI agents in 2025.
Company status
independent
Use cases & customers
Primary use cases
Target customers
Deployment options
Integrations
HTTP Request actions reach any tool with an API, with unlimited connectors and library stories for CrowdStrike, Jira, Slack, Azure Sentinel, AWS and others. Webhook and email triggers start stories. Tines also offers an API, Terraform support and an MCP server at the tenant's /mcp endpoint for outside AI clients.
In practice
An Azure Sentinel alert lands and the analyst on call gathers context by hand. A Tines library story triages Sentinel incidents with the AI Agent action and hands back a summary the team can act on.
Analysts keep asking whether an IP address or hash is malicious. A Tines agent story answers IOC lookups straight from Slack, using the threat intelligence tools the team already connected.
You want AI help in the SOC without giving it free rein. Tines Workbench runs your own stories as tools and asks the analyst to confirm before any step that changes the environment.
Sources & related URLs
Agentic Index coverage score
11.5 / 14 capabilities · 82%
| Integrations & Tool Calling | Full |
|---|---|
|
HTTP Request actions call any tool with an API using tenant credentials. Unlimited connectors come on every edition, and library stories let agents act in CrowdStrike, Jira, Slack, Azure Sentinel, AWS and others with the customer's own credentials. Further library stories work with Code42, Reality Defender and Google Threat Intelligence, Send Email actions deliver mail from a story, and Workbench and the AI Agent action can call remote MCP servers as tools. The free edition already includes unlimited users, spaces and connectors. SourceTines, tines.com/library, /pricing and tines.com/docs AI Agent action; tines.com/stories/docs/actions/typesread 2026-10-05 |
|
| Workflow Orchestration | Full |
|
Teams build stories from webhook, email, HTTP request, condition, event transform, Send to Story and AI Agent actions, chaining stories and agents into their own flows. The AI Agent action runs in task mode, as a one shot prompt or an autonomous agent that calls tools toward an objective, or in chat mode on a Tines page where users talk to it until a set goal is met. Its tools can be public or custom templates, other stories attached through Send to Story with their own timeouts, custom tools built in the same story and remote MCP servers, and Condition actions branch a story's path. SourceTines, tines.com/docs AI Agent action and action types; tines.com/stories/docs/actions/typesread 2026-10-05 |
|
| Knowledge Grounding & RAG | Partial |
|
Workbench reaches the customer's proprietary data in real time by running stories as tools, and Records and Resources hold structured data for stories. Tines offers no published knowledge base or search index for the AI to draw on. Users can send Cases and events into Workbench for context and attach images or documents of up to 4.5 MB, three to a message, and skills hold reusable task instructions written in place or imported as markdown files. SourceTines, tines.com/stories/docs/workbenchread 2026-10-05 |
|
| Human Oversight & Guardrails | Full |
|
In Workbench, templates that may change the environment "will prompt the user to confirm before running", and any story can be set to "Require confirmation to run". The story then waits for a person to approve it before anything runs. The library includes a story for requesting and approving Slack posts to a restricted channel. Admins allocate AI credits to teams, and token use thresholds can send a notification or switch the AI Agent action off. SourceTines, tines.com/stories/docs/workbench, tines.com/library and tines.com/docs AI Agent actionread 2026-10-05 |
|
| Security, Identity & Governance | Full |
|
Tines holds SOC 2 Type II, audited annually, with reports in the trust center. SSO/SAML comes on all plans, along with teams that separate users, credentials, resources and stories, user administration, IP access control and action egress control. Workbench gives each user only the credentials and stories their permissions allow, and AI providers can be scoped to specific teams, with the team that owns a provider's credential always keeping access. SourceTines, tines.com/security, tines.com/stories/docs/workbench and AI admin docsread 2026-10-05 |
|
| Observability & Auditability | Full |
|
Every action in a story emits events that record each step of a run. All actions performed in Workbench are available in audit logs, and an audit log is captured whenever a user changes data in the tenant. Every agent run appears in those events and logs. Token use is tracked against each team's AI credit allowance, with notifications as a team nears its limit. SourceTines, tines.com/stories/docs/workbench and AI admin docsread 2026-10-05 |
|
| Memory & State Persistence | Partial |
|
Workbench keeps chat history that users can search, rename and delete, and Records persist structured data across story runs. Tines does not describe the AI Agent action remembering anything from one run to the next. How long chat history is kept depends on the plan, users can set custom instructions for their conversations, and an agent in chat mode keeps the conversation going until its goal is met. SourceTines, tines.com/stories/docs/workbench and tines.com/docs AI Agent actionread 2026-10-05 |
|
| Deployment & Data Residency | Full |
|
Tines is both a cloud service that Tines hosts and a product that customers can host themselves. Self hosted Tines runs in the customer's environment on AWS ECS and EKS, Azure, Google Kubernetes Engine, Red Hat OpenShift, VMware and Docker Compose, and paid editions list flexible deployment options. The hosted service also has an EU stack, where web search is limited by egress restrictions. The free edition runs three live workflows, and paid editions remove the limit. SourceTines, tines.com/stories/docs/self-hosted, /pricing and tines.com/stories/docs/workbenchread 2026-10-05 |
|
| Prebuilt Agents, Templates & Packs | Full |
|
Customers import prebuilt stories from a public library, including AI agent templates such as triaging Azure Sentinel incidents with an AI Agent and looking up IOCs via Slack using an agent. The library spans security, IT operations, infrastructure, engineering, product, asset and app management, employee lifecycle, incidents and alerts, communication and ticket synchronization, with stories such as analyzing SMS messages for scams with OCR and AI, containing or releasing CrowdStrike hosts from Jira and detecting deepfakes with Reality Defender. Workbench adds prebuilt templates that need only credentials, and team admins can package tools, credentials and instructions as Presets. SourceTines, tines.com/library and tines.com/stories/docs/workbenchread 2026-10-05 |
|
| Triggers & Channel Coverage | Full |
|
Webhook actions start stories on inbound events from external services, and Receive Email actions start them on inbound mail, without a prompt. An AI Agent in chat mode sits on a Tines page where people start conversations, and Workbench takes Cases and events sent to it. Outside AI clients can also run stories through the Tines MCP server. SourceTines, tines.com/stories/docs/actions/types, Workbench and AI Agent action docsread 2026-10-05 |
|
| Model Flexibility & Routing | Full |
|
AI features run on Anthropic's Claude through AWS Bedrock by default, and "it is possible to bring your own AI provider to power all of our AI features", scoped to teams by credential. Bring your own model is listed on paid editions. Admins can set separate smart and fast models, providers brought in can be OpenAI, Anthropic, Azure OpenAI, Helicone, OpenRouter, xAI or Ollama, and each AI Agent action picks its own model from those available. The free edition comes with a one time $50 AI allowance. SourceTines, tines.com/stories/docs/admin/ai, /pricing and tines.com/docs AI Agent action; tines.com/stories/docs/adminread 2026-10-05 |
|
| APIs, SDKs & MCP Extensibility | Full |
|
Developers get the Tines API, Terraform support and a Tines MCP server at https://your-tenant.tines.com/mcp with OAuth, whose tools read, create, update, validate and run stories and actions from outside AI clients. Sourcetines.com/stories/docs/mcp-serverread 2026-09-28 |
|
| Testing, Debugging & Optimization | Partial |
|
Story contents can be validated before they run, and a validation tool is exposed through the MCP server; both check the story's configuration. Tines publishes no way to run an AI Agent action against test cases and score its answers. An output schema can make the AI Agent action return JSON that is validated against it, and each action sets its own temperature from 0 to 1. SourceTines, tines.com/stories/docs/mcp-server and tines.com/docs AI Agent actionread 2026-10-05 |
|
| Browser & Computer Use | Not documented |
|
Browser or screen use by Tines agents is not described. Tines acts through API actions. The AI Agent action's built in tools are a planning scratchpad, code analysis and web search, which fetches page content for the agent to read. SourceTines, tines.com/stories/docs/actions/types and tines.com/docs AI Agent actionread 2026-10-05 |
|
The Agentic Index coverage score grades every vendor Full, Partial or Not documented against the same 14 buyer facing capabilities, from public evidence only. Each capability links to how all vendors in the index score on it. How this evidence is graded
Product updates
AI clients connected to the Tines MCP server can now create, update and delete records and record types, where before they could only read them. Record creates can carry idempotency keys that make retries safe for 24 hours, and write actions are scrubbed before logging so audit events keep identifiers and counts without field values.
Bears on: Observability / auditability
View sourceTines released Records API v2 with endpoints for reading records and record types, searching records, and aggregating results. Requests can select fields by name or ID and include linked cases, child records, and full artifacts in the same call. The API standardizes response and error handling for workflows that retrieve Records data.
Bears on: MCP / tool calling / API
View sourceTines launched autonomous AI agents within its workflow automation platform. These agents enable customers to build intelligent, context-aware workflows that can act independently, suggest next steps, and collaborate with users in real time.
Bears on: Agent capability
View sourcePricing
Free edition with unlimited users and connectors, 3 live workflows and a one time $50 AI allowance. Paid editions are priced by demo.
Billing is by edition, free or paid. The units paid editions are priced in are not published.
Included quota
The Free edition includes 3 live workflows and a one time $50 AI allowance.
What is public
The Free edition's limits are published, with unlimited users, spaces and connectors, 3 live workflows and a one time $50 AI allowance. Paid edition features are listed, and paid prices are not.
Variable cost rationale
Users, spaces and connectors are unlimited on every edition, so headcount does not drive the bill. AI features on the Free edition draw on a one time $50 AI allowance, and no rate for AI use beyond it is published. Paid editions add unlimited workflows and can bring their own AI model, which moves inference cost to the customer's own AI provider. Paid prices and units are quoted by demo, so no published cap or meter limits the bill.
Sales call required
Yes, required for paid access
Free / trial
Free edition with 3 live workflows, a one time $50 AI allowance and unlimited users, spaces and connectors
Lowest paid plan
Not published
Key ambiguities
Paid edition prices and units are not published. The Free edition's $50 AI allowance is one time, and no price is shown for AI use beyond it.
Related vendors
- 7AI — Agentic SOC from the Cybereason founders: domain specialized agents…
- Abnormal AI — Behavioral AI email security with three named autonomous agents: a…
- AirMDR — AI native MDR whose AI analyst investigates every alert and writes…
- Airrived — Agentic OS that unifies SOC, GRC, IAM, vulnerability management, IT,…
- Andesite — Human-AI SOC platform where customers build their own agents and…
- Anvilogic — Agentic security operations platform that works on top of existing…
Alternatives to Tines
The closest documented capability profiles to Tines among security and SOC agents tracked by Agentic Index, ordered by similarity on the same 14 point evidence the rankings use. No vendor pays for placement.
- CrowdStrike12.0 / 14Fuller documented coverage on Knowledge Grounding & RAG
- Dropzone AI11.0 / 14A lighter documented profile than TinesTines vs Dropzone AI →
- D3 Security (Morpheus)10.5 / 14A lighter documented profile than Tines
- Palo Alto Networks10.5 / 14A lighter documented profile than Tines
- Swimlane10.5 / 14A lighter documented profile than Tines
- Torq12.5 / 14Fuller documented coverage on Knowledge Grounding & RAG and Testing, Debugging & Optimization
Similarity is computed from each vendor's Agentic Index coverage score evidence, axis by axis, not from the totals. How this evidence is graded