Back to vendors
T

Tines

Also known as: Tines Workbench, Tines Storyboard

Visit site
Entry priceFree edition with unlimited users and connectors, 3 live workflows and a one time $50 AI allowance. Paid editions are priced by demo.Full pricing detail

Workflow and AI orchestration platform where security and IT teams build stories with AI Agent actions or import them from a prebuilt library, with Workbench confirmation before changes, bring your own model, an API and MCP server, and self hosting.

Tines is a workflow and AI orchestration platform for security and IT teams. Teams build stories, automated workflows made of actions (webhooks, inbound email, HTTP requests to any API, conditions, event transforms, Send to Story and AI Agent actions), and can import prebuilt stories from a public library that includes AI agent templates such as Azure Sentinel incident triage and IOC lookups over Slack. Workbench is an AI chat interface that runs stories as tools against the customer's own data and systems, loads Cases, keeps searchable chat history, and asks the user to confirm before any template that may change the environment runs. Any story can be set to require confirmation.

Every action emits events recording each step, and all Workbench actions and data changes go to audit logs. AI features run on Anthropic's Claude through AWS Bedrock by default, and customers can bring their own AI provider. Tines offers an API, Terraform support and an MCP server that lets outside AI clients read, build, validate and run stories. It is available as a hosted cloud service or self hosted on AWS, Azure, Google Cloud, Kubernetes, OpenShift or VMware. SSO/SAML comes on all plans, with teams for access separation, and Tines maintains SOC 2 Type II. A free edition includes three live workflows and a one time AI allowance.

Vendor details

Canonical URL

https://www.tines.com

Category

Security / SOC agent

Funding status

Independent, co-headquartered in Dublin and Boston. Tines launched Workbench in 2024 and AI agents in 2025.

Company status

independent

Use cases & customers

Primary use cases

security workflow orchestration and automation (SOAR)autonomous alert triage and investigation via AI agentsnatural-language SecOps action through Workbenchincident case management with SLA metricsIT and cross-team workflow automation

Target customers

enterprise security operations centersIT and infrastructure teamsMSSPs and security consultanciesdetection engineering and incident response teams

Deployment options

Tines-hosted cloudself-hosted on AWS, Azure, Google Cloud, Kubernetes, OpenShift, VMware or Docker Compose

Integrations

HTTP Request actions reach any tool with an API, with unlimited connectors and library stories for CrowdStrike, Jira, Slack, Azure Sentinel, AWS and others. Webhook and email triggers start stories. Tines also offers an API, Terraform support and an MCP server at the tenant's /mcp endpoint for outside AI clients.

In practice

An Azure Sentinel alert lands and the analyst on call gathers context by hand. A Tines library story triages Sentinel incidents with the AI Agent action and hands back a summary the team can act on.

Analysts keep asking whether an IP address or hash is malicious. A Tines agent story answers IOC lookups straight from Slack, using the threat intelligence tools the team already connected.

You want AI help in the SOC without giving it free rein. Tines Workbench runs your own stories as tools and asks the analyst to confirm before any step that changes the environment.

Agentic Index coverage score

11.5 / 14 capabilities · 82%

Integrations & Tool Calling Full

HTTP Request actions call any tool with an API using tenant credentials. Unlimited connectors come on every edition, and library stories let agents act in CrowdStrike, Jira, Slack, Azure Sentinel, AWS and others with the customer's own credentials. Further library stories work with Code42, Reality Defender and Google Threat Intelligence, Send Email actions deliver mail from a story, and Workbench and the AI Agent action can call remote MCP servers as tools. The free edition already includes unlimited users, spaces and connectors.

SourceTines, tines.com/library, /pricing and tines.com/docs AI Agent action; tines.com/stories/docs/actions/typesread 2026-10-05

Workflow Orchestration Full

Teams build stories from webhook, email, HTTP request, condition, event transform, Send to Story and AI Agent actions, chaining stories and agents into their own flows. The AI Agent action runs in task mode, as a one shot prompt or an autonomous agent that calls tools toward an objective, or in chat mode on a Tines page where users talk to it until a set goal is met. Its tools can be public or custom templates, other stories attached through Send to Story with their own timeouts, custom tools built in the same story and remote MCP servers, and Condition actions branch a story's path.

SourceTines, tines.com/docs AI Agent action and action types; tines.com/stories/docs/actions/typesread 2026-10-05

Knowledge Grounding & RAG Partial

Workbench reaches the customer's proprietary data in real time by running stories as tools, and Records and Resources hold structured data for stories. Tines offers no published knowledge base or search index for the AI to draw on. Users can send Cases and events into Workbench for context and attach images or documents of up to 4.5 MB, three to a message, and skills hold reusable task instructions written in place or imported as markdown files.

SourceTines, tines.com/stories/docs/workbenchread 2026-10-05

Human Oversight & Guardrails Full

In Workbench, templates that may change the environment "will prompt the user to confirm before running", and any story can be set to "Require confirmation to run". The story then waits for a person to approve it before anything runs. The library includes a story for requesting and approving Slack posts to a restricted channel. Admins allocate AI credits to teams, and token use thresholds can send a notification or switch the AI Agent action off.

SourceTines, tines.com/stories/docs/workbench, tines.com/library and tines.com/docs AI Agent actionread 2026-10-05

Security, Identity & Governance Full

Tines holds SOC 2 Type II, audited annually, with reports in the trust center. SSO/SAML comes on all plans, along with teams that separate users, credentials, resources and stories, user administration, IP access control and action egress control. Workbench gives each user only the credentials and stories their permissions allow, and AI providers can be scoped to specific teams, with the team that owns a provider's credential always keeping access.

SourceTines, tines.com/security, tines.com/stories/docs/workbench and AI admin docsread 2026-10-05

Observability & Auditability Full

Every action in a story emits events that record each step of a run. All actions performed in Workbench are available in audit logs, and an audit log is captured whenever a user changes data in the tenant. Every agent run appears in those events and logs. Token use is tracked against each team's AI credit allowance, with notifications as a team nears its limit.

SourceTines, tines.com/stories/docs/workbench and AI admin docsread 2026-10-05

Memory & State Persistence Partial

Workbench keeps chat history that users can search, rename and delete, and Records persist structured data across story runs. Tines does not describe the AI Agent action remembering anything from one run to the next. How long chat history is kept depends on the plan, users can set custom instructions for their conversations, and an agent in chat mode keeps the conversation going until its goal is met.

SourceTines, tines.com/stories/docs/workbench and tines.com/docs AI Agent actionread 2026-10-05

Deployment & Data Residency Full

Tines is both a cloud service that Tines hosts and a product that customers can host themselves. Self hosted Tines runs in the customer's environment on AWS ECS and EKS, Azure, Google Kubernetes Engine, Red Hat OpenShift, VMware and Docker Compose, and paid editions list flexible deployment options. The hosted service also has an EU stack, where web search is limited by egress restrictions. The free edition runs three live workflows, and paid editions remove the limit.

SourceTines, tines.com/stories/docs/self-hosted, /pricing and tines.com/stories/docs/workbenchread 2026-10-05

Prebuilt Agents, Templates & Packs Full

Customers import prebuilt stories from a public library, including AI agent templates such as triaging Azure Sentinel incidents with an AI Agent and looking up IOCs via Slack using an agent.

The library spans security, IT operations, infrastructure, engineering, product, asset and app management, employee lifecycle, incidents and alerts, communication and ticket synchronization, with stories such as analyzing SMS messages for scams with OCR and AI, containing or releasing CrowdStrike hosts from Jira and detecting deepfakes with Reality Defender. Workbench adds prebuilt templates that need only credentials, and team admins can package tools, credentials and instructions as Presets.

SourceTines, tines.com/library and tines.com/stories/docs/workbenchread 2026-10-05

Triggers & Channel Coverage Full

Webhook actions start stories on inbound events from external services, and Receive Email actions start them on inbound mail, without a prompt. An AI Agent in chat mode sits on a Tines page where people start conversations, and Workbench takes Cases and events sent to it. Outside AI clients can also run stories through the Tines MCP server.

SourceTines, tines.com/stories/docs/actions/types, Workbench and AI Agent action docsread 2026-10-05

Model Flexibility & Routing Full

AI features run on Anthropic's Claude through AWS Bedrock by default, and "it is possible to bring your own AI provider to power all of our AI features", scoped to teams by credential. Bring your own model is listed on paid editions. Admins can set separate smart and fast models, providers brought in can be OpenAI, Anthropic, Azure OpenAI, Helicone, OpenRouter, xAI or Ollama, and each AI Agent action picks its own model from those available. The free edition comes with a one time $50 AI allowance.

SourceTines, tines.com/stories/docs/admin/ai, /pricing and tines.com/docs AI Agent action; tines.com/stories/docs/adminread 2026-10-05

APIs, SDKs & MCP Extensibility Full

Developers get the Tines API, Terraform support and a Tines MCP server at https://your-tenant.tines.com/mcp with OAuth, whose tools read, create, update, validate and run stories and actions from outside AI clients.

Sourcetines.com/stories/docs/mcp-serverread 2026-09-28

Testing, Debugging & Optimization Partial

Story contents can be validated before they run, and a validation tool is exposed through the MCP server; both check the story's configuration. Tines publishes no way to run an AI Agent action against test cases and score its answers. An output schema can make the AI Agent action return JSON that is validated against it, and each action sets its own temperature from 0 to 1.

SourceTines, tines.com/stories/docs/mcp-server and tines.com/docs AI Agent actionread 2026-10-05

Browser & Computer Use Not documented

Browser or screen use by Tines agents is not described. Tines acts through API actions. The AI Agent action's built in tools are a planning scratchpad, code analysis and web search, which fetches page content for the agent to read.

SourceTines, tines.com/stories/docs/actions/types and tines.com/docs AI Agent actionread 2026-10-05

The Agentic Index coverage score grades every vendor Full, Partial or Not documented against the same 14 buyer facing capabilities, from public evidence only. Each capability links to how all vendors in the index score on it. How this evidence is graded

Product updates

·MCP / tool calling / APIVerified

AI clients connected to the Tines MCP server can now create, update and delete records and record types, where before they could only read them. Record creates can carry idempotency keys that make retries safe for 24 hours, and write actions are scrubbed before logging so audit events keep identifiers and counts without field values.

Bears on: Observability / auditability

View source
·MCP / tool calling / APIVerified

Tines released Records API v2 with endpoints for reading records and record types, searching records, and aggregating results. Requests can select fields by name or ID and include linked cases, child records, and full artifacts in the same call. The API standardizes response and error handling for workflows that retrieve Records data.

Bears on: MCP / tool calling / API

View source
·Agent capabilityPartially Verified

Tines launched autonomous AI agents within its workflow automation platform. These agents enable customers to build intelligent, context-aware workflows that can act independently, suggest next steps, and collaborate with users in real time.

Bears on: Agent capability

View source
View all 11 Tines updates →Tracked since Aug 2026 · Verified from public vendor sources

Pricing

Free edition with unlimited users and connectors, 3 live workflows and a one time $50 AI allowance. Paid editions are priced by demo.

Billing is by edition, free or paid. The units paid editions are priced in are not published.

Free tierTrial available

Included quota

The Free edition includes 3 live workflows and a one time $50 AI allowance.

What is public

The Free edition's limits are published, with unlimited users, spaces and connectors, 3 live workflows and a one time $50 AI allowance. Paid edition features are listed, and paid prices are not.

Variable cost rationale

Users, spaces and connectors are unlimited on every edition, so headcount does not drive the bill. AI features on the Free edition draw on a one time $50 AI allowance, and no rate for AI use beyond it is published. Paid editions add unlimited workflows and can bring their own AI model, which moves inference cost to the customer's own AI provider. Paid prices and units are quoted by demo, so no published cap or meter limits the bill.

Sales call required

Yes, required for paid access

Free / trial

Free edition with 3 live workflows, a one time $50 AI allowance and unlimited users, spaces and connectors

Lowest paid plan

Not published

Key ambiguities

Paid edition prices and units are not published. The Free edition's $50 AI allowance is one time, and no price is shown for AI use beyond it.

Agentic Index verified 2026-09-28

Alternatives to Tines

The closest documented capability profiles to Tines among security and SOC agents tracked by Agentic Index, ordered by similarity on the same 14 point evidence the rankings use. No vendor pays for placement.

Similarity is computed from each vendor's Agentic Index coverage score evidence, axis by axis, not from the totals. How this evidence is graded

Contact us

Found a vendor we missed? Have feedback on the index? We'd love to hear from you.