Prospector Studio Release 2026.07.24 — Multi-Instance Code Mode and Platform Reliability

Prospector Studio Release 2026.07.24 is out — 100 commits since our last release. This cycle is built around two priorities: giving Code Mode a proper multi-instance tooling foundation, and hardening the platform's reliability under load across the entire infrastructure.

Introducing Code Mode — Programmable Tool Orchestration in Prospector Studio

Code Mode is a JavaScript execution environment built into the agent: instead of describing one tool call at a time, you write a short program that chains, branches, loops, and parallelizes tool calls with real control flow, and get back a single consolidated result. It sits alongside Prospector Studio's existing DAG-based workflows, which already fan out independent steps as parallel branches shaped in advance — Code Mode is for the runs where the shape isn't known ahead of time, deciding branches, loops, and retries as it goes rather than upfront.

What Code Mode Is

In practice, that means the agent runs your program in one pass instead of trading tool calls back and forth with you step by step:

// Fetch a schema and a sample query in parallel
const [schema, sample] = await Promise.all([
  tools["devo"].list_columns({ tableName: "firewall.cisco.asa" }),
  tools["devo"].execute_query({ query: "from firewall.cisco.asa select action limit 5" })
]);
return { schema, sample };

That single block replaces two sequential tool calls with one parallel run, and returns exactly the shape of result you asked for — no stitching required on your end.

What You Get

Parallel Execution

Independent tool calls no longer have to wait on each other. A Promise.all across a dozen tables runs as one batch instead of twelve sequential requests, so multi-table surveys and cross-source checks come back in a fraction of the time.

Chaining

The result of one tool call can feed directly into the next. Probe a data source for volume, then decide how to query it, then shape the output — all in one pass, with no manual round-tripping between steps.

Conditional Logic

Code Mode supports real control flow: if/else, loops, switch statements. A workflow can probe first and adapt its strategy based on what it finds — for example, pulling everything in one request if a result set is small, or paginating automatically if it's large.

const probe = await tools["devo"].get_filtered_alert_definitions({ pageSize: 1, pageNumber: 1 });
const total = probe.pagination.totalElements;

if (total <= 99) {
  const all = await tools["devo"].get_filtered_alert_definitions({ pageSize: 100, pageNumber: 1 });
  return all.object;
} else {
  const pages = Math.ceil(total / 100);
  let results = [];
  for (let i = 1; i <= pages; i++) {
    const page = await tools["devo"].get_filtered_alert_definitions({ pageSize: 100, pageNumber: i });
    results = results.concat(page.object);
  }
  return results;
}

Error Handling

Individual failures no longer take down an entire run. try/catch around a single tool call means a batch job can report a failure on one item while still completing successfully on the rest — instead of an all-or-nothing result.

const results = await Promise.all(
  tables.map(async (t) => {
    try {
      const r = await tools["devo"].execute_query({ query: `from ${t} select count() limit 1` });
      return { table: t, count: r.object?.[0]?.n ?? 0 };
    } catch (err) {
      return { table: t, error: err.message };
    }
  })
);

Aggregation

Results from many calls can be collected, merged, and shaped into a single return value — no back-and-forth needed to assemble a final answer from scattered pieces.

Built With Guardrails

Code Mode runs are capped by a per-run tool-call budget (50 calls by default), which keeps runs predictable and steers workflows toward fewer, broader requests rather than many narrow ones. Tool calls are plain async/await with JSON results — no envelopes to unwrap, no parsing required — and console.log output is available for diagnostics. There's no import or require; it's plain JavaScript, scoped to the tools you already have access to.

Where This Helps Most

• Schema discovery + query in one step — pull a table's structure and a sample of its data in a single parallel run.
• Multi-table surveys — check volume or health across a dozen tables simultaneously instead of one at a time.
• Paginated retrieval — probe a result set, then automatically choose between a single fetch or a full paginated sweep.
• Conditional workflows — adapt the strategy mid-run based on what earlier steps return.
• Resilient batch operations — process a whole batch and get partial results back even if a few items fail.

Reusable Snippets

Chat blocks can now be saved as reusable snippets directly from a conversation, so a useful prompt, query, or workflow fragment doesn't have to be rebuilt from scratch every time — save it once from the chat and pull it back into any future session.

Native Workflow LLM Node & Test Runs

Workflows now support a native LLM node, and Code Mode ships Test Runs: structured and raw result views backed by S3 storage, so you can execute a workflow, inspect exactly what happened, and keep the run history around for comparison.

Consent & Access Controls

Tool access across Code Mode is consent-gated at a granular, per-tool level, with an allowlist model and the ability to expose standalone or ask-first tools directly. Connector tools registered by agents are closed by default and require an explicit wildcard grant to open up. The connector calls honor configured timeouts, coerce argument types correctly, and fail loudly instead of silently swallowing errors.

Platform Reliability & Stability

A large share of this release went into hardening the systems that keep cases moving and executions running, particularly under heavier load.

ASOC Stability

ASOC now has fan-out overload protection via a dedicated execution admission gate and its own database connection pool, so a burst of alerts will not starve the rest of the system. False-positive short-circuiting, an ingest overlap guard, and bulk case delete round out the data-integrity work, alongside a fix so correlation case titles no longer overflow their column limit.

Studio Stability

A browser memory leak caused by a lingering WebSocket/subscription connection on token refresh is fixed, and the Fleet, Gateways, Workflow Builder, Webhooks, and Organization tabs now correctly respect dark/light theme instead of falling back to defaults.

Threat Intel & StrikeKit

Threat Intel Knowledge Base Access

Threat Intel now has knowledge base access through MCP, and a new Studio Results panel surfaces security insights directly where you're already working, without switching context.

StrikeKit: OWASP Top 10:2025 & In-App Support

StrikeKit adds engagement planning built around the OWASP Top 10:2025, so engagements can be scoped and structured against the current standard from the start. A new in-app Help sidebar (HelpLive) puts customer support one click away, and reports now get automatic PII and credential redaction so sensitive values don't end up in shared output. Scope edits are also guarded while an engagement is live, and a regression that disabled the Send button during plan refinement is fixed.

Additional Improvements

• MSSP: Keycloak connector and admin client provisioning for in-app child realms, extending the MSSP management model shipped last release.
• Workflows: Orphaned executions can now be cancelled directly, and status filters have been corrected. Legacy base32-padded task IDs are now tolerated rather than rejected.
• Triggers: Disabled triggers now correctly reject test-trigger requests.
• Studio: Report "Open in new tab" now routes through the artifact URL, and case CSV export correctly fills the Project column.
• Mero/Slack: Connection reliability improvements (active-active handling with coordinated recycling) and semantic memory deduplication.