{ "data": { "similar": [ { "grade": "B", "json": "https://www.anchorterminal.com/tools/robocorp.json", "name": "Robocorp", "score": 65.5, "shared": [ "desktop.rpa", "desktop.control", "desktop.orchestration" ], "slug": "robocorp" }, { "grade": "D", "json": "https://www.anchorterminal.com/tools/automation-anywhere.json", "name": "Automation Anywhere", "score": 50.9, "shared": [ "desktop.rpa", "desktop.orchestration", "desktop.control" ], "slug": "automation-anywhere" }, { "grade": "BB", "json": "https://www.anchorterminal.com/tools/robot-framework.json", "name": "Robot Framework", "score": 76.4, "shared": [ "desktop.rpa" ], "slug": "robot-framework" }, { "grade": "D", "json": "https://www.anchorterminal.com/tools/autohotkey.json", "name": "AutoHotkey", "score": 52.8, "shared": [ "desktop.control" ], "slug": "autohotkey" }, { "grade": "D", "json": "https://www.anchorterminal.com/tools/autoit.json", "name": "AutoIt", "score": 46.3, "shared": [ "desktop.control" ], "slug": "autoit" } ], "tool": { "slug": "uipath", "name": "UiPath", "vendor": "UiPath", "vendorUrl": "https://www.uipath.com", "kind": "http-api", "category": "desktop-automation", "summary": "UiPath is a robotic process automation platform whose hosted Orchestrator runs robots that operate desktop, web and Windows applications. Outside agents start and monitor jobs through the Orchestrator API or folder-scoped MCP servers in Automation Cloud.", "url": "https://www.anchorterminal.com/tools/uipath", "markdownUrl": "https://www.anchorterminal.com/tools/uipath.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/uipath.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/uipath.json", "license": "Proprietary service under the UiPath Master Software and Services Agreement, the Community Agreement for the free plan", "transports": [ "http" ], "remoteUrl": "https://cloud.uipath.com/{org}/{tenant}/agenthub_/mcp/{folderKey}/{slug}", "packages": [ { "registry": "pypi", "name": "uipath" } ], "auth": "oauth", "authNotes": "OAuth 2.0 throughout. MCP servers take a bearer token on every request from four sources. The MCP OAuth flow (authorisation server discovery, Client ID Metadata Documents or dynamic client registration, tokens bound to one server by RFC 8707 resource indicators, gated by an AI Trust Layer policy that is off unless an administrator enables it). Personal access tokens with chosen Orchestrator scopes and a lifetime of up to one year. External applications using client credentials (the only unattended route) or user scopes with PKCE. Interactive login through `uipath auth`, with one-hour tokens. The caller needs `MCPServers.View` in the folder, and Coded and Command servers also need `Jobs.Create`. Access is the intersection of token scopes and folder roles.", "pricing": "freemium", "pricingNotes": "The Community plan is free with no time limit, by direct sign-up, with one tenant, one Pro and one Plus user, one Unattended Robot and a monthly Credits pool. Basic starts at $25 a month with two robots and limited agent calls, hosted in Europe. Standard (60-day free trial) and Enterprise are priced by sales, and user and robot licences are sold across tiers without published prices. Whether a card is needed for Community was not stated (checked 2026-10-14).", "priceSummary": "$25 / mo", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the Orchestrator API guide, the MCP server pages or the pricing page (checked 2026-10-14).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-14" }, "docsUrl": "https://docs.uipath.com/orchestrator/automation-cloud/latest/user-guide/about-mcp-servers", "llmsTxt": "https://docs.uipath.com/llms.txt", "capabilities": [ "desktop.rpa", "desktop.orchestration", "desktop.control" ], "tags": [ "hosted", "official", "oauth", "enterprise", "odata", "mcp", "python", "closed-source", "audit-log", "freemium", "llms-txt", "webhooks" ], "lastRelease": "2026-10-12", "graded": true, "anchor": { "graded": true, "score": 68.2, "grade": "B", "agentReady": false, "rank": 237, "ranked": true, "rankOf": 1076, "categoryRank": 2, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 73, "maintenance": 80, "payments": 25, "reliability": 62, "schema": 79, "security": 82, "transparency": 76 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 62, "points": 12.4, "reason": "Graded on the hosted Orchestrator API and MCP servers. Public Atlassian Statuspage at status.uipath.com with component and incident history (20). The 90-day feed has several major incidents, including robot job failures in Europe from 10:00 to 17:23 UTC on 10 September 2026, solution deployments failing from 15:18 to 20:45 UTC on 11 September, Cloud Robot jobs stuck pending in the US for 94 minutes on 2 October and an expired certificate taking down several ML services across regions on 13 October (0). Per-endpoint rate limits with numbers (15). 429 responses carry Retry-After and X-RateLimit-Remaining, with retry guidance. No idempotency key for StartJobs was found (12 of 15). The Automation Cloud page states a 99.9 per cent uptime SLA, but the SLA document with credits was not found publicly (5 of 10). The Orchestrator API and the UiPath MCP server type are generally available, with Platform and Swagger servers in preview (10)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 79, "points": 12.84, "reason": "The Orchestrator API is described in OpenAPI 3.0, served per tenant at the Orchestrator URL plus /swagger/index.html rather than as a public file (20 of 25). llms.txt at docs.uipath.com and a Markdown copy of every page by adding .md (10). API pages state scope and limits clearly, such as which fields GET /odata/Jobs omits. MCP tool descriptions come from the description of each published artifact, so quality depends on the owner (12 of 20). OData types and an enumerated types reference. MCP tool inputs follow each process's arguments (11 of 15). Request examples on each API page and a table of custom error codes (14 of 15). Monthly dated release notes. UiPath says the Swagger version number should not be relied on (12 of 15)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 73, "points": 11.86, "reason": "An MCP server holds only the tools a person chose for one folder, and the API takes $select, $top and $expand (22 of 25). $filter, $orderby, $top and $count, with export endpoints for bulk reads (20). HTTP codes plus numbered custom errors such as 1002 ItemNotFound and 4502 for the daily export limit (16 of 20). No idempotency key for starting jobs, and no readOnlyHint or destructiveHint described for MCP tools (6 of 20). Every folder call needs a folder header and StartJobs needs a release key. A Python SDK and CLI exist; a second official SDK language was not confirmed (9 of 15)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 82, "points": 14.35, "reason": "MCP OAuth with resource indicators binding a token to one server, external apps with OAuth scopes such as OR.Jobs, and PATs with chosen scopes and an expiry of up to one year (30). Folder roles limit what a token can do, and automatic client registration is off until an administrator enables it in the AI Trust Layer. No approval step before destructive API calls was found (14 of 20). Tools return job outputs from robots that read third-party applications, and no prompt-injection guidance was found in the MCP pages (5 of 15). Orchestrator audit logs and a preview API audit view (13 of 15). security.txt valid until 2028 with a HackerOne programme, and SOC 2 Type 2, ISO/IEC 27001 and FedRAMP Moderate claimed on the Automation Cloud page (20)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 25, "points": 3.13, "reason": "No x402, MPP or L402 (0). Basic is published at $25 a month and the Community plan is free, while Standard, Enterprise and extra robots are priced by sales (10). The Community plan is free with no time limit by direct sign-up. No page we read says whether a card is needed (15 of 20). A person signs up in a browser and creates the PAT or external application (0)." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 80, "points": 7, "reason": "Orchestrator release notes dated 12 October 2026 (30). Entries on 5, 7 and 12 October and nine dates in September (20). Public dated release notes, a forum and a support portal. Support was not tested (12 of 15). The Python SDK `uipath` 2.14.37 was published on 12 October 2026. UiPath's MCP servers are not in the official MCP registry, where a search returned only a third-party server (12 of 15). The SDK's CI was not checked (6 of 10)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 76, "points": 6.65, "note": "editorial 57, provenance 94", "reason": "Closed service with published terms pages, though the MSSA that governs paid use is signed per customer and not public (15). The privacy policy covers cloud product data, says it may be used for product improvement and machine learning under the customer contract and warns against personal data on Community. The legal page dates it 30 November 2018, and the DPA download was not read (15 of 30). A product lifecycle policy and a dated deprecation timeline for the Swagger 2.0 specification (17 of 20). Hosting regions are named, such as Europe for Basic. No subprocessor list was read (10 of 20)." } ], "assessment": { "date": "2026-10-14", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "An MCP server holds only the tools a person chose for one folder, and the API takes $select, $top and $expand (22 of 25). $filter, $orderby, $top and $count, with export endpoints for bulk reads (20). HTTP codes plus numbered custom errors such as 1002 ItemNotFound and 4502 for the daily export limit (16 of 20). No idempotency key for starting jobs, and no readOnlyHint or destructiveHint described for MCP tools (6 of 20). Every folder call needs a folder header and StartJobs needs a release key. A Python SDK and CLI exist; a second official SDK language was not confirmed (9 of 15).", "maintenance": "Orchestrator release notes dated 12 October 2026 (30). Entries on 5, 7 and 12 October and nine dates in September (20). Public dated release notes, a forum and a support portal. Support was not tested (12 of 15). The Python SDK `uipath` 2.14.37 was published on 12 October 2026. UiPath's MCP servers are not in the official MCP registry, where a search returned only a third-party server (12 of 15). The SDK's CI was not checked (6 of 10).", "payments": "No x402, MPP or L402 (0). Basic is published at $25 a month and the Community plan is free, while Standard, Enterprise and extra robots are priced by sales (10). The Community plan is free with no time limit by direct sign-up. No page we read says whether a card is needed (15 of 20). A person signs up in a browser and creates the PAT or external application (0).", "reliability": "Graded on the hosted Orchestrator API and MCP servers. Public Atlassian Statuspage at status.uipath.com with component and incident history (20). The 90-day feed has several major incidents, including robot job failures in Europe from 10:00 to 17:23 UTC on 10 September 2026, solution deployments failing from 15:18 to 20:45 UTC on 11 September, Cloud Robot jobs stuck pending in the US for 94 minutes on 2 October and an expired certificate taking down several ML services across regions on 13 October (0). Per-endpoint rate limits with numbers (15). 429 responses carry Retry-After and X-RateLimit-Remaining, with retry guidance. No idempotency key for StartJobs was found (12 of 15). The Automation Cloud page states a 99.9 per cent uptime SLA, but the SLA document with credits was not found publicly (5 of 10). The Orchestrator API and the UiPath MCP server type are generally available, with Platform and Swagger servers in preview (10).", "schema": "The Orchestrator API is described in OpenAPI 3.0, served per tenant at the Orchestrator URL plus /swagger/index.html rather than as a public file (20 of 25). llms.txt at docs.uipath.com and a Markdown copy of every page by adding .md (10). API pages state scope and limits clearly, such as which fields GET /odata/Jobs omits. MCP tool descriptions come from the description of each published artifact, so quality depends on the owner (12 of 20). OData types and an enumerated types reference. MCP tool inputs follow each process's arguments (11 of 15). Request examples on each API page and a table of custom error codes (14 of 15). Monthly dated release notes. UiPath says the Swagger version number should not be relied on (12 of 15).", "security": "MCP OAuth with resource indicators binding a token to one server, external apps with OAuth scopes such as OR.Jobs, and PATs with chosen scopes and an expiry of up to one year (30). Folder roles limit what a token can do, and automatic client registration is off until an administrator enables it in the AI Trust Layer. No approval step before destructive API calls was found (14 of 20). Tools return job outputs from robots that read third-party applications, and no prompt-injection guidance was found in the MCP pages (5 of 15). Orchestrator audit logs and a preview API audit view (13 of 15). security.txt valid until 2028 with a HackerOne programme, and SOC 2 Type 2, ISO/IEC 27001 and FedRAMP Moderate claimed on the Automation Cloud page (20).", "transparency": "Closed service with published terms pages, though the MSSA that governs paid use is signed per customer and not public (15). The privacy policy covers cloud product data, says it may be used for product improvement and machine learning under the customer contract and warns against personal data on Community. The legal page dates it 30 November 2018, and the DPA download was not read (15 of 30). A product lifecycle policy and a dated deprecation timeline for the Swagger 2.0 specification (17 of 20). Hosting regions are named, such as Europe for Basic. No subprocessor list was read (10 of 20)." }, "sources": [ { "what": "MCP server types", "url": "https://docs.uipath.com/orchestrator/automation-cloud/latest/user-guide/about-mcp-servers.md", "seen": "2026-10-14" }, { "what": "MCP server authentication and URL format", "url": "https://docs.uipath.com/orchestrator/automation-cloud/latest/user-guide/mcp-server-authentication.md", "seen": "2026-10-14" }, { "what": "MCP OAuth flow", "url": "https://docs.uipath.com/orchestrator/automation-cloud/latest/user-guide/authenticating-with-the-mcp-oauth-flow.md", "seen": "2026-10-14" }, { "what": "personal access tokens for MCP", "url": "https://docs.uipath.com/orchestrator/automation-cloud/latest/user-guide/authenticating-with-a-personal-access-token.md", "seen": "2026-10-14" }, { "what": "rate limits", "url": "https://docs.uipath.com/orchestrator/automation-cloud/latest/api-guide/rate-limits.md", "seen": "2026-10-14" }, { "what": "API specification read me and Swagger 2.0 deprecation", "url": "https://docs.uipath.com/orchestrator/automation-cloud/latest/api-guide/read-me.md", "seen": "2026-10-14" }, { "what": "response codes", "url": "https://docs.uipath.com/orchestrator/automation-cloud/latest/api-guide/response-codes.md", "seen": "2026-10-14" }, { "what": "jobs requests and StartJobs", "url": "https://docs.uipath.com/orchestrator/automation-cloud/latest/api-guide/jobs-requests.md", "seen": "2026-10-14" }, { "what": "Orchestrator release notes, October 2026", "url": "https://docs.uipath.com/orchestrator/automation-cloud/latest/release-notes/october-2026.md", "seen": "2026-10-14" }, { "what": "Orchestrator release notes, September 2026", "url": "https://docs.uipath.com/orchestrator/automation-cloud/latest/release-notes/september-2026.md", "seen": "2026-10-14" }, { "what": "status incident history feed", "url": "https://status.uipath.com/history.rss", "seen": "2026-10-14" }, { "what": "pricing", "url": "https://www.uipath.com/pricing", "seen": "2026-10-14" }, { "what": "Community plan", "url": "https://docs.uipath.com/automation-cloud/automation-cloud/latest/admin-guide/community-plan.md", "seen": "2026-10-14" }, { "what": "legal terms", "url": "https://www.uipath.com/legal/trust-and-security/legal-terms", "seen": "2026-10-14" }, { "what": "privacy policy", "url": "https://www.uipath.com/legal/trust-and-security/privacy-policy", "seen": "2026-10-14" }, { "what": "Automation Cloud product page (certifications, SLA claim)", "url": "https://www.uipath.com/product/automation-cloud", "seen": "2026-10-14" }, { "what": "security.txt", "url": "https://www.uipath.com/.well-known/security.txt", "seen": "2026-10-14" }, { "what": "Python SDK on PyPI", "url": "https://pypi.org/pypi/uipath/json", "seen": "2026-10-14" } ], "openQuestions": [ "unchecked: the text of the Automation Cloud SLA and its service credits; only the 99.9 per cent claim on the product page and status page was read", "unchecked: the Data Processing Agreement and a subprocessor list", "unchecked: whether Community sign-up asks for a card", "unchecked: the GitHub repository for the `uipath` Python SDK, which the GitHub API did not return, so CI and issue response were not assessed" ] }, "negative": 0, "verdict": "Orchestrator exposes published RPA workflows, agents and API workflows as MCP tools over Streamable HTTP, with MCP OAuth, scoped PATs and an OpenAPI 3.0 API. Prices above the $25 Basic plan need a sales conversation, and the status page logged several multi-hour incidents between 10 September and 13 October 2026.", "bestFor": "An agent that needs to drive Windows desktop or legacy applications through robots a company already runs, started as MCP tools or API jobs.", "strengths": [ "Folder-scoped MCP servers turn chosen processes, agents and API workflows into tools at a URL of the form cloud.uipath.com/{org}/{tenant}/agenthub_/mcp/{folderKey}/{slug}", "MCP OAuth flow with Client ID Metadata Documents, dynamic registration and RFC 8707 resource binding, plus PATs scoped to OR.Jobs and OR.Execution", "Rate limits published per endpoint, with Retry-After and X-RateLimit-Remaining headers on 429 responses", "llms.txt index and a Markdown copy of every docs page by adding .md to the URL", "security.txt valid until 2028 pointing to a HackerOne programme, and SOC 2 Type 2 and ISO/IEC 27001 claimed for Automation Cloud" ], "weaknesses": [ "Standard and Enterprise prices are not published, and robot licences are sold through sales", "Status history shows robot job failures in Europe for over seven hours on 10 September 2026 and a certificate expiry hitting several services on 13 October 2026", "No idempotency key was found for StartJobs, and the MCP pages say nothing about readOnlyHint or destructiveHint", "The OpenAPI document is served per tenant behind the Orchestrator URL, not as a public file", "Tools backed by Integration Service activities time out with PATs or client credentials and need user-context sign-in" ], "agentNotes": [ "Send `Authorization: Bearer \u003ctoken\u003e` on every MCP request. The `mcp-session-id` header carries no authentication", "Give a PAT both `OR.Execution` (list tools) and `OR.Jobs` (run tools), or tool listing or calls fail", "Use client credentials from an external application for unattended runs. It is the only method that needs no person at sign-in", "Add a folder header such as `X-UIPATH-FolderKey` to Orchestrator API calls on folder resources", "Read job outputs with `GET /odata/Jobs({key})`. `GET /odata/Jobs` returns InputArguments and OutputArguments as null and is limited to 100 calls a minute per tenant" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 68.2 } ], "editorialScores": { "ergonomics": 73, "maintenance": 80, "payments": 25, "reliability": 62, "schema": 79, "security": 82, "transparency": 57 }, "provenanceScore": 94 }, "connect": { "http": "curl -X POST \"https://cloud.uipath.com/{org}/{tenant}/agenthub_/mcp/{folderKey}/{slug}\" \\\n -H \"Authorization: Bearer $UIPATH_PAT\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"jsonrpc\":\"2.0\",\"method\":\"initialize\",\"params\":{...},\"id\":1}'" }, "letme": { "capability": "https://letme.dev/desktop.rpa", "tool": "https://letme.dev/uipath" }, "notable": [ "Seven MCP server types in Orchestrator. UiPath, Remote, Command, Coded and Self-Hosted, with Platform and Swagger servers in preview since 17 September 2026 (https://docs.uipath.com/orchestrator/automation-cloud/latest/user-guide/about-mcp-servers.md)", "Every MCP request must carry a bearer token. PATs need OR.Execution to list tools and OR.Jobs to run them, because tools call ListReleases and StartJobs (https://docs.uipath.com/orchestrator/automation-cloud/latest/user-guide/authenticating-with-a-personal-access-token.md)", "GET /odata/Jobs and GET /odata/QueueItems are limited to 100 requests a minute per tenant from integrations and 1,000 from automations. Starting jobs and adding queue items are not limited (https://docs.uipath.com/orchestrator/automation-cloud/latest/api-guide/rate-limits.md)", "The Orchestrator API specification is OpenAPI 3.0. The Swagger 2.0 version was deprecated in August 2026 and removed from Automation Cloud in September 2026 (https://docs.uipath.com/orchestrator/automation-cloud/latest/api-guide/read-me.md)", "Status history lists robot job failures in Europe from 10:00 to 17:23 UTC on 10 September 2026 and an expired certificate affecting several ML services in multiple regions on 13 October 2026 (https://status.uipath.com/history.rss)", "The Python SDK `uipath` reached 2.14.37 on 12 October 2026, its eighth release since 1 October (https://pypi.org/pypi/uipath/json)" ], "area": "developer", "details": [ { "label": "Interfaces", "value": "Orchestrator API (OData, OpenAPI 3.0 at {AutomationCloudURL}/{org}/{tenant}/orchestrator_/swagger/index.html) and MCP servers over Streamable HTTP at https://cloud.uipath.com/{org}/{tenant}/agenthub_/mcp/{folderKey}/{slug}" }, { "label": "MCP server types", "value": "UiPath (exposes published RPA workflows, agents, API workflows, Maestro BPMN processes and Integration Service activities), Remote, Command, Coded, Self-Hosted. Platform and Swagger types in preview" }, { "label": "Starting a run", "value": "POST /odata/Jobs/UiPath.Server.Configuration.OData.StartJobs with a folder header, input arguments up to 10,000 characters of JSON. API triggers start a job from a custom URL with a PAT or OAuth (https://docs.uipath.com/orchestrator/automation-cloud/latest/api-guide/jobs-requests.md)" }, { "label": "Credentials", "value": "MCP OAuth flow, personal access tokens (up to one year), external applications (client credentials, user scopes, PKCE), interactive login through the UiPath CLI" }, { "label": "Rate limits", "value": "100 requests a minute per tenant for GET Jobs and QueueItems from integrations, 1,000 from automations, 100 a day per tenant for export endpoints. 429 responses carry Retry-After and X-RateLimit-Remaining" }, { "label": "Errors", "value": "HTTP status codes plus a table of custom error codes such as 1001 NameAlreadyUsed and 1002 ItemNotFound (https://docs.uipath.com/orchestrator/automation-cloud/latest/api-guide/response-codes.md)" }, { "label": "Audit", "value": "Orchestrator audit logs and an API audit view of GetAll Jobs and QueueItems calls over 30 days (preview). Personal Workspace changes added to audit logs on 12 October 2026" }, { "label": "Free tier", "value": "Community plan, free with no time limit, one Pro and one Plus user, one Unattended Robot and a monthly Credits pool, under the Community Agreement of 27 July 2026" }, { "label": "Platforms", "value": "Robots run Windows desktop, web and other applications on the customer's machines or UiPath Cloud Robots. Automation Cloud is hosted in eight regions according to the product page" }, { "label": "Docs for agents", "value": "https://docs.uipath.com/llms.txt indexes every product, and any docs page returns Markdown when .md is added to its URL" } ], "unitPrices": [ { "item": "Automation Cloud Basic", "unit": "month", "usd": 25, "note": "starting price, up to 5 Basic, 5 Plus and 1 Pro user, 2 robots, limited agent calls, hosted in Europe" } ], "provenance": { "legalEntity": "UiPath Inc.", "domain": "uipath.com", "domainRegistered": "2011-10-26", "domainNote": "API and MCP endpoints answer on cloud.uipath.com. www.uipath.com/.well-known/security.txt names security@uipath.com and https://hackerone.com/uipath and expires on 2028-06-26.", "endpointOnVendorDomain": true, "terms": "https://www.uipath.com/legal/trust-and-security/legal-terms", "privacy": "https://www.uipath.com/legal/trust-and-security/privacy-policy", "statusPage": "https://status.uipath.com", "changelog": "https://docs.uipath.com/orchestrator/automation-cloud/latest/release-notes/october-2026", "securityTxt": "valid", "checked": "2026-10-14", "notes": [ "The legal terms page says paid products fall under the UiPath Master Software and Services Agreement signed with each customer, the Community plan under the Community Agreement (updated 27 July 2026) and trials and previews under the Master Evaluation Agreement (updated 12 June 2026). The MSSA itself is not public.", "The same page lists the privacy policy's last update as 30 November 2018. A Data Processing Agreement is published as a download, which we did not read.", "The legal entities named are UiPath SRL, Bucharest, and UiPath Inc., One Vanderbilt Ave., New York.", "status.uipath.com is an Atlassian Statuspage. Its robots.txt disallows /api/, so incident history was read from /history.rss.", "RDAP for uipath.com gives a registration date of 2011-10-26." ], "score": 94, "checks": [ { "check": "Legal entity named", "value": "UiPath Inc.", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "uipath.com, registered 2011-10-26 (14 years)", "points": 15, "max": 15, "state": "ok" }, { "check": "Endpoint on the vendor's domain", "value": "cloud.uipath.com", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "published, but our reader couldn't read it", "points": 7, "max": 10, "state": "part" }, { "check": "Privacy policy", "value": "read, states 7 of the 8 things a reader expects, and has 1 clause that costs points", "points": 7.3, "max": 10, "state": "part" }, { "check": "Status page", "value": "status.uipath.com", "points": 10, "max": 10, "state": "ok" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "valid", "points": 10, "max": 10, "state": "ok" } ], "policies": [ { "kind": "terms", "url": "https://www.uipath.com/legal/trust-and-security/legal-terms", "state": "unreadable", "reason": "the page is an index of UiPath's legal documents, not the terms themselves", "readAt": "2026-10-14", "points": 7, "max": 10, "notes": [ { "date": "2026-10-14", "text": "Under AI Terms, the page lists the Anthropic Commercial Terms of Service as an end user agreement.", "quote": "Anthropic: End User Agreement: Anthropic Commercial Terms of Service" } ] }, { "kind": "privacy", "url": "https://www.uipath.com/legal/trust-and-security/privacy-policy", "state": "read", "readAt": "2026-10-14", "words": 6532, "points": 7.3, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": false }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": true, "quote": "This policy together with the Terms of Use of this website and any other documents we mention in this policy is meant to inform you on which personal data about you we collect, use, disclose, share or otherwise process when you are using this website, our products and our services." }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": true, "quote": "Personal data will be deleted at the latest in 18 months after the membership ends or at request.", "says": "Names a period of 18 months" }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": true, "quote": "Any Personal Data you use with third-party products may be visible to the third-party providers and will be processed in accordance with their own privacy documentation, and UiPath will bear no liability thereof." }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": true, "quote": "We do not sell or share mobile or personal data with third parties, affiliates, or partners for marketing or promotional purposes.", "says": "Says it does not sell personal data" }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": true, "quote": "UiPath cares about protecting the right to privacy of individuals and, while we observe the applicable local laws, we aim to uphold the Personal Data protection principles provided by the GDPR even for non-EU UiPath entities." }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": true, "quote": "Please contact us at dpo@uipath.com if you have any questions or objections.", "says": "dpo@uipath.com" }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": true, "quote": "…UK, to a third country, UiPath makes sure that there is a valid transfer mechanism in place, such as Standard Contractual Clauses or an International Data Transfer Addendum to the European Commission’s standard contractual clauses for international data transfers, to make sure that your personal data is protected.", "says": "Relies on standard contractual clauses" } ], "toKnow": [ { "key": "training", "label": "Says it may use customer content to train or improve models, and no opt-out was found", "found": true, "quote": "When you use UiPath’s cloud products, the data used with the products may be used for product improvement and machine learning purposes, based on the contract with our customers, to provide them with improved functionalities.", "costsPoints": true } ], "notes": [ { "date": "2026-10-14", "text": "Conversations with the agentic chat support on the website and Partner Portal are processed through sub-processors, including to improve future responses.", "quote": "We process conversations through our sub-processors (such as Cloudflare Inc. or Tribble Inc.) in order to provide you with the functionality and to improve future responses." } ] } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/uipath.json", "live": { "slug": "uipath", "probe": { "target": "https://cloud.uipath.com/{org}/{tenant}/agenthub_/mcp/{folderKey}/{slug}", "method": "get", "lastAt": "2026-10-14T09:42:11.862232308Z", "lastOk": false, "lastStatus": 500, "lastMs": 81, "lastNote": "server error", "authRequired": false, "uptime24h": 0, "uptime30d": 0, "p50ms24h": 0, "p95ms24h": 0, "samples24h": 17, "samples30d": 17, "days": [ { "date": "2026-10-14", "probes": 17, "ok": 0 } ], "outages": [ { "start": "2026-10-14T08:08:01.334877924Z", "end": "0001-01-01T00:00:00Z", "note": "HTTP 500 server error" } ] }, "vendorStatus": { "page": "https://status.uipath.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-10-14T09:39:45.309729146Z" }, "updatedAt": "2026-10-14T09:42:11.862232308Z" } }, "verify": { "accepts": "a page on uipath.com or one of its subdomains", "badgeUrl": "https://www.anchorterminal.com/badges/uipath.svg", "body": { "slug": "uipath", "url": "the page with the badge or the link" }, "docs": "https://www.anchorterminal.com/builders/#verify", "effect": "none, it never changes a grade, rank or review", "endpoint": "https://www.anchorterminal.com/api/v1/verify", "listingUrl": "https://www.anchorterminal.com/tools/uipath", "mcpTool": "verify_listing", "recheck": "weekly; two failed checks in a row and it lapses, a later pass restores it", "snippets": { "html": "\u003ca href=\"https://www.anchorterminal.com/tools/uipath\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/uipath.svg\" alt=\"UiPath on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e", "markdown": "[![UiPath on Anchor Terminal](https://www.anchorterminal.com/badges/uipath.svg)](https://www.anchorterminal.com/tools/uipath)", "link": "\u003ca href=\"https://www.anchorterminal.com/tools/uipath\"\u003eUiPath on Anchor Terminal\u003c/a\u003e" } } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/tools/uipath", "json": "https://www.anchorterminal.com/tools/uipath.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/tools/uipath.md", "slim": "https://www.anchorterminal.com/tools/uipath.min.md" }, "markdown": "## Overview\n\n**Grade B · 68.2/100 · rank #237 of 1076 · #2 in Desktop \u0026 mobile app control · not agent-ready · confidence medium**\n\n\n## Assessment\n\nOrchestrator exposes published RPA workflows, agents and API workflows as MCP tools over Streamable HTTP, with MCP OAuth, scoped PATs and an OpenAPI 3.0 API. Prices above the $25 Basic plan need a sales conversation, and the status page logged several multi-hour incidents between 10 September and 13 October 2026.\n\n## Facts\n\n| Field | Value |\n| --- | --- |\n| Vendor | UiPath (https://www.uipath.com) |\n| Kind | HTTP API |\n| Category | Desktop \u0026 mobile app control (https://www.anchorterminal.com/categories/desktop-automation) |\n| Transport | HTTP |\n| Endpoint | `https://cloud.uipath.com/{org}/{tenant}/agenthub_/mcp/{folderKey}/{slug}` |\n| Auth | OAuth · OAuth 2.0 throughout. MCP servers take a bearer token on every request from four sources. The MCP OAuth flow (authorisation server discovery, Client ID Metadata Documents or dynamic client registration, tokens bound to one server by RFC 8707 resource indicators, gated by an AI Trust Layer policy that is off unless an administrator enables it). Personal access tokens with chosen Orchestrator scopes and a lifetime of up to one year. External applications using client credentials (the only unattended route) or user scopes with PKCE. Interactive login through `uipath auth`, with one-hour tokens. The caller needs `MCPServers.View` in the folder, and Coded and Command servers also need `Jobs.Create`. Access is the intersection of token scopes and folder roles. |\n| Pricing | Freemium ($25 / mo) · The Community plan is free with no time limit, by direct sign-up, with one tenant, one Pro and one Plus user, one Unattended Robot and a monthly Credits pool. Basic starts at $25 a month with two robots and limited agent calls, hosted in Europe. Standard (60-day free trial) and Enterprise are priced by sales, and user and robot licences are sold across tiers without published prices. Whether a card is needed for Community was not stated (checked 2026-10-14). |\n| x402 | No · No x402, MPP or L402 in the Orchestrator API guide, the MCP server pages or the pricing page (checked 2026-10-14). |\n| Licence | Proprietary service under the UiPath Master Software and Services Agreement, the Community Agreement for the free plan |\n| Packages | pypi: `uipath` |\n| Docs | https://docs.uipath.com/orchestrator/automation-cloud/latest/user-guide/about-mcp-servers |\n| llms.txt | https://docs.uipath.com/llms.txt |\n| Last release | 2026-10-12 |\n| Interfaces | Orchestrator API (OData, OpenAPI 3.0 at {AutomationCloudURL}/{org}/{tenant}/orchestrator_/swagger/index.html) and MCP servers over Streamable HTTP at https://cloud.uipath.com/{org}/{tenant}/agenthub_/mcp/{folderKey}/{slug} |\n| MCP server types | UiPath (exposes published RPA workflows, agents, API workflows, Maestro BPMN processes and Integration Service activities), Remote, Command, Coded, Self-Hosted. Platform and Swagger types in preview |\n| Starting a run | POST /odata/Jobs/UiPath.Server.Configuration.OData.StartJobs with a folder header, input arguments up to 10,000 characters of JSON. API triggers start a job from a custom URL with a PAT or OAuth (https://docs.uipath.com/orchestrator/automation-cloud/latest/api-guide/jobs-requests.md) |\n| Credentials | MCP OAuth flow, personal access tokens (up to one year), external applications (client credentials, user scopes, PKCE), interactive login through the UiPath CLI |\n| Rate limits | 100 requests a minute per tenant for GET Jobs and QueueItems from integrations, 1,000 from automations, 100 a day per tenant for export endpoints. 429 responses carry Retry-After and X-RateLimit-Remaining |\n| Errors | HTTP status codes plus a table of custom error codes such as 1001 NameAlreadyUsed and 1002 ItemNotFound (https://docs.uipath.com/orchestrator/automation-cloud/latest/api-guide/response-codes.md) |\n| Audit | Orchestrator audit logs and an API audit view of GetAll Jobs and QueueItems calls over 30 days (preview). Personal Workspace changes added to audit logs on 12 October 2026 |\n| Free tier | Community plan, free with no time limit, one Pro and one Plus user, one Unattended Robot and a monthly Credits pool, under the Community Agreement of 27 July 2026 |\n| Platforms | Robots run Windows desktop, web and other applications on the customer's machines or UiPath Cloud Robots. Automation Cloud is hosted in eight regions according to the product page |\n| Docs for agents | https://docs.uipath.com/llms.txt indexes every product, and any docs page returns Markdown when .md is added to its URL |\n| Capabilities | desktop.rpa, desktop.orchestration, desktop.control |\n| Tags | hosted, official, oauth, enterprise, odata, mcp, python, closed-source, audit-log, freemium, llms-txt, webhooks |\n| JSON | https://www.anchorterminal.com/api/v1/tools/uipath.json |\n\n## Score breakdown (methodology v0.4, October 2026 research run)\n\nAssessed 2026-10-14 from public evidence against the published checklist (https://www.anchorterminal.com/benchmark/#checklist). Confidence: medium. Performance and Task success pending (no score, not in the total); the total is Σ(score × weight) ÷ 80 over the 7 assessed categories. \"This run\" is each category's share of the 100 points.\n\n| Category | Weight | This run | Score (0–100) | Points |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% | 20 | 62 | 12.4 |\n| Performance | 10% | pending | pending | n/a |\n| Schema \u0026 documentation | 13% | 16.2 | 79 | 12.8 |\n| Agent ergonomics | 13% | 16.2 | 73 | 11.9 |\n| Security \u0026 auth | 14% | 17.5 | 82 | 14.3 |\n| Payments \u0026 pricing | 10% | 12.5 | 25 | 3.1 |\n| Task success | 10% | pending | pending | n/a |\n| Maintenance \u0026 community | 7% | 8.8 | 80 | 7.0 |\n| Transparency \u0026 trust (editorial 57, provenance 94) | 7% | 8.8 | 76 | 6.7 |\n| Negative events | up to −15 | up to −15 | none recorded | 0 |\n| **Total** | | | | **68.2 → B** |\n\n### Why each score\n\n- Reliability 62: Graded on the hosted Orchestrator API and MCP servers. Public Atlassian Statuspage at status.uipath.com with component and incident history (20). The 90-day feed has several major incidents, including robot job failures in Europe from 10:00 to 17:23 UTC on 10 September 2026, solution deployments failing from 15:18 to 20:45 UTC on 11 September, Cloud Robot jobs stuck pending in the US for 94 minutes on 2 October and an expired certificate taking down several ML services across regions on 13 October (0). Per-endpoint rate limits with numbers (15). 429 responses carry Retry-After and X-RateLimit-Remaining, with retry guidance. No idempotency key for StartJobs was found (12 of 15). The Automation Cloud page states a 99.9 per cent uptime SLA, but the SLA document with credits was not found publicly (5 of 10). The Orchestrator API and the UiPath MCP server type are generally available, with Platform and Swagger servers in preview (10).\n- Performance: Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes.\n- Schema \u0026 documentation 79: The Orchestrator API is described in OpenAPI 3.0, served per tenant at the Orchestrator URL plus /swagger/index.html rather than as a public file (20 of 25). llms.txt at docs.uipath.com and a Markdown copy of every page by adding .md (10). API pages state scope and limits clearly, such as which fields GET /odata/Jobs omits. MCP tool descriptions come from the description of each published artifact, so quality depends on the owner (12 of 20). OData types and an enumerated types reference. MCP tool inputs follow each process's arguments (11 of 15). Request examples on each API page and a table of custom error codes (14 of 15). Monthly dated release notes. UiPath says the Swagger version number should not be relied on (12 of 15).\n- Agent ergonomics 73: An MCP server holds only the tools a person chose for one folder, and the API takes $select, $top and $expand (22 of 25). $filter, $orderby, $top and $count, with export endpoints for bulk reads (20). HTTP codes plus numbered custom errors such as 1002 ItemNotFound and 4502 for the daily export limit (16 of 20). No idempotency key for starting jobs, and no readOnlyHint or destructiveHint described for MCP tools (6 of 20). Every folder call needs a folder header and StartJobs needs a release key. A Python SDK and CLI exist; a second official SDK language was not confirmed (9 of 15).\n- Security \u0026 auth 82: MCP OAuth with resource indicators binding a token to one server, external apps with OAuth scopes such as OR.Jobs, and PATs with chosen scopes and an expiry of up to one year (30). Folder roles limit what a token can do, and automatic client registration is off until an administrator enables it in the AI Trust Layer. No approval step before destructive API calls was found (14 of 20). Tools return job outputs from robots that read third-party applications, and no prompt-injection guidance was found in the MCP pages (5 of 15). Orchestrator audit logs and a preview API audit view (13 of 15). security.txt valid until 2028 with a HackerOne programme, and SOC 2 Type 2, ISO/IEC 27001 and FedRAMP Moderate claimed on the Automation Cloud page (20).\n- Payments \u0026 pricing 25: No x402, MPP or L402 (0). Basic is published at $25 a month and the Community plan is free, while Standard, Enterprise and extra robots are priced by sales (10). The Community plan is free with no time limit by direct sign-up. No page we read says whether a card is needed (15 of 20). A person signs up in a browser and creates the PAT or external application (0).\n- Task success: Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored.\n- Maintenance \u0026 community 80: Orchestrator release notes dated 12 October 2026 (30). Entries on 5, 7 and 12 October and nine dates in September (20). Public dated release notes, a forum and a support portal. Support was not tested (12 of 15). The Python SDK `uipath` 2.14.37 was published on 12 October 2026. UiPath's MCP servers are not in the official MCP registry, where a search returned only a third-party server (12 of 15). The SDK's CI was not checked (6 of 10).\n- Transparency \u0026 trust 76: Closed service with published terms pages, though the MSSA that governs paid use is signed per customer and not public (15). The privacy policy covers cloud product data, says it may be used for product improvement and machine learning under the customer contract and warns against personal data on Community. The legal page dates it 30 November 2018, and the DPA download was not read (15 of 30). A product lifecycle policy and a dated deprecation timeline for the Swagger 2.0 specification (17 of 20). Hosting regions are named, such as Europe for Basic. No subprocessor list was read (10 of 20).\n\nFix list for a coding agent, everything this grade says the listing lacks, the biggest gain first (13 items): https://www.anchorterminal.com/fixes/uipath.md (JSON https://www.anchorterminal.com/fixes/uipath.json)\n\n### What we couldn't check\n\n- unchecked: the text of the Automation Cloud SLA and its service credits; only the 99.9 per cent claim on the product page and status page was read\n- unchecked: the Data Processing Agreement and a subprocessor list\n- unchecked: whether Community sign-up asks for a card\n- unchecked: the GitHub repository for the `uipath` Python SDK, which the GitHub API did not return, so CI and issue response were not assessed\n\n### Sources\n\n- MCP server types: \u003chttps://docs.uipath.com/orchestrator/automation-cloud/latest/user-guide/about-mcp-servers.md\u003e (seen 2026-10-14)\n- MCP server authentication and URL format: \u003chttps://docs.uipath.com/orchestrator/automation-cloud/latest/user-guide/mcp-server-authentication.md\u003e (seen 2026-10-14)\n- MCP OAuth flow: \u003chttps://docs.uipath.com/orchestrator/automation-cloud/latest/user-guide/authenticating-with-the-mcp-oauth-flow.md\u003e (seen 2026-10-14)\n- personal access tokens for MCP: \u003chttps://docs.uipath.com/orchestrator/automation-cloud/latest/user-guide/authenticating-with-a-personal-access-token.md\u003e (seen 2026-10-14)\n- rate limits: \u003chttps://docs.uipath.com/orchestrator/automation-cloud/latest/api-guide/rate-limits.md\u003e (seen 2026-10-14)\n- API specification read me and Swagger 2.0 deprecation: \u003chttps://docs.uipath.com/orchestrator/automation-cloud/latest/api-guide/read-me.md\u003e (seen 2026-10-14)\n- response codes: \u003chttps://docs.uipath.com/orchestrator/automation-cloud/latest/api-guide/response-codes.md\u003e (seen 2026-10-14)\n- jobs requests and StartJobs: \u003chttps://docs.uipath.com/orchestrator/automation-cloud/latest/api-guide/jobs-requests.md\u003e (seen 2026-10-14)\n- Orchestrator release notes, October 2026: \u003chttps://docs.uipath.com/orchestrator/automation-cloud/latest/release-notes/october-2026.md\u003e (seen 2026-10-14)\n- Orchestrator release notes, September 2026: \u003chttps://docs.uipath.com/orchestrator/automation-cloud/latest/release-notes/september-2026.md\u003e (seen 2026-10-14)\n- status incident history feed: \u003chttps://status.uipath.com/history.rss\u003e (seen 2026-10-14)\n- pricing: \u003chttps://www.uipath.com/pricing\u003e (seen 2026-10-14)\n- Community plan: \u003chttps://docs.uipath.com/automation-cloud/automation-cloud/latest/admin-guide/community-plan.md\u003e (seen 2026-10-14)\n- legal terms: \u003chttps://www.uipath.com/legal/trust-and-security/legal-terms\u003e (seen 2026-10-14)\n- privacy policy: \u003chttps://www.uipath.com/legal/trust-and-security/privacy-policy\u003e (seen 2026-10-14)\n- Automation Cloud product page (certifications, SLA claim): \u003chttps://www.uipath.com/product/automation-cloud\u003e (seen 2026-10-14)\n- security.txt: \u003chttps://www.uipath.com/.well-known/security.txt\u003e (seen 2026-10-14)\n- Python SDK on PyPI: \u003chttps://pypi.org/pypi/uipath/json\u003e (seen 2026-10-14)\n\n## Who's behind it (provenance 94/100, checked 2026-10-14)\n\n| Check | Finding | Points |\n| --- | --- | --- |\n| Legal entity named | UiPath Inc. | 20/20 |\n| Domain age | uipath.com, registered 2011-10-26 (14 years) | 15/15 |\n| Endpoint on the vendor's domain | cloud.uipath.com | 15/15 |\n| Terms of service | published, but our reader couldn't read it | 7/10 |\n| Privacy policy | read, states 7 of the 8 things a reader expects, and has 1 clause that costs points | 7.3/10 |\n| Status page | status.uipath.com | 10/10 |\n| Changelog | published | 10/10 |\n| security.txt | valid | 10/10 |\n\nAPI and MCP endpoints answer on cloud.uipath.com. www.uipath.com/.well-known/security.txt names security@uipath.com and https://hackerone.com/uipath and expires on 2028-06-26.\n\nThe legal terms page says paid products fall under the UiPath Master Software and Services Agreement signed with each customer, the Community plan under the Community Agreement (updated 27 July 2026) and trials and previews under the Master Evaluation Agreement (updated 12 June 2026). The MSSA itself is not public.\n\nThe same page lists the privacy policy's last update as 30 November 2018. A Data Processing Agreement is published as a download, which we did not read.\n\nThe legal entities named are UiPath SRL, Bucharest, and UiPath Inc., One Vanderbilt Ave., New York.\n\nstatus.uipath.com is an Atlassian Statuspage. Its robots.txt disallows /api/, so incident history was read from /history.rss.\n\nRDAP for uipath.com gives a registration date of 2011-10-26.\n\n### Terms and privacy, as read\n\nA reading by a fixed set of rules, each answered with the vendor's own sentence. Not legal advice.\n\n**Terms of service** (https://www.uipath.com/legal/trust-and-security/legal-terms), read 2026-10-14. Our reader couldn't read it (the page is an index of UiPath's legal documents, not the terms themselves).\n\n- Also in the text (2026-10-14). Under AI Terms, the page lists the Anthropic Commercial Terms of Service as an end user agreement. \"Anthropic: End User Agreement: Anthropic Commercial Terms of Service\"\n\n**Privacy policy** (https://www.uipath.com/legal/trust-and-security/privacy-policy), read 2026-10-14, gives no date, states 7 of the 8 things a reader expects.\n\n- To know. Says it may use customer content to train or improve models, and no opt-out was found (costs points). \"When you use UiPath’s cloud products, the data used with the products may be used for product improvement and machine learning purposes, based on the contract with our customers, to provide them with improved functionalities.\"\n- Not found in the text. Gives the date it was last updated.\n- Says how long data is kept. Names a period of 18 months.\n- Says whether personal data is sold or shared for advertising. Says it does not sell personal data.\n- Gives a privacy contact. dpo@uipath.com.\n- Says where data is transferred or stored. Relies on standard contractual clauses.\n- Also in the text (2026-10-14). Conversations with the agentic chat support on the website and Partner Portal are processed through sub-processors, including to improve future responses. \"We process conversations through our sub-processors (such as Cloudflare Inc. or Tribble Inc.) in order to provide you with the functionality and to improve future responses.\"\n\n## Live (updated 2026-10-14 09:42 UTC)\n\n- Right now: down, HTTP 500, 81 ms, checked 2026-10-14 09:42 UTC (get on `https://cloud.uipath.com/{org}/{tenant}/agenthub_/mcp/{folderKey}/{slug}`)\n- Uptime 24h 0.0% (17 probes) · 30 days 0.0% (17 probes) · p50 n/a · p95 n/a\n- Vendor status page: none, All Systems Operational\n- Always current: https://www.anchorterminal.com/api/v1/live/uipath.json\n\n## Probe metrics\n\nNot measured yet. Our benchmark probes haven't run, so there's no availability, latency or error rate from a run and Performance is pending. Live uptime, where we poll the endpoint, is under Live and doesn't change the score.\n\n## Prices\n\n| Item | Price | Unit | Note |\n| --- | --- | --- | --- |\n| Automation Cloud Basic | $25 | per month (plan) | starting price, up to 5 Basic, 5 Plus and 1 Pro user, 2 robots, limited agent calls, hosted in Europe |\n\nAcross all listings: https://www.anchorterminal.com/prices/index.md\n\n## Strengths\n\n- Folder-scoped MCP servers turn chosen processes, agents and API workflows into tools at a URL of the form cloud.uipath.com/{org}/{tenant}/agenthub_/mcp/{folderKey}/{slug}\n- MCP OAuth flow with Client ID Metadata Documents, dynamic registration and RFC 8707 resource binding, plus PATs scoped to OR.Jobs and OR.Execution\n- Rate limits published per endpoint, with Retry-After and X-RateLimit-Remaining headers on 429 responses\n- llms.txt index and a Markdown copy of every docs page by adding .md to the URL\n- security.txt valid until 2028 pointing to a HackerOne programme, and SOC 2 Type 2 and ISO/IEC 27001 claimed for Automation Cloud\n\n## Weaknesses\n\n- Standard and Enterprise prices are not published, and robot licences are sold through sales\n- Status history shows robot job failures in Europe for over seven hours on 10 September 2026 and a certificate expiry hitting several services on 13 October 2026\n- No idempotency key was found for StartJobs, and the MCP pages say nothing about readOnlyHint or destructiveHint\n- The OpenAPI document is served per tenant behind the Orchestrator URL, not as a public file\n- Tools backed by Integration Service activities time out with PATs or client credentials and need user-context sign-in\n\n## Before you call it (notes for agents)\n\n1. Send `Authorization: Bearer \u003ctoken\u003e` on every MCP request. The `mcp-session-id` header carries no authentication\n2. Give a PAT both `OR.Execution` (list tools) and `OR.Jobs` (run tools), or tool listing or calls fail\n3. Use client credentials from an external application for unattended runs. It is the only method that needs no person at sign-in\n4. Add a folder header such as `X-UIPATH-FolderKey` to Orchestrator API calls on folder resources\n5. Read job outputs with `GET /odata/Jobs({key})`. `GET /odata/Jobs` returns InputArguments and OutputArguments as null and is limited to 100 calls a minute per tenant\n\n## Connect\n\nFirst request:\n\n```bash\ncurl -X POST \"https://cloud.uipath.com/{org}/{tenant}/agenthub_/mcp/{folderKey}/{slug}\" \\\n -H \"Authorization: Bearer $UIPATH_PAT\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"jsonrpc\":\"2.0\",\"method\":\"initialize\",\"params\":{...},\"id\":1}'\n```\n\nThrough letme (picks today, calling later): https://letme.dev/uipath (letme picks it for desktop.control, the top-graded tool for the job, letme picks it for desktop.orchestration, the top-graded tool for the job). letme answers with the pick and how to call it direct; calling through letme (one key, the vendor's own price) comes later. How it works: https://www.anchorterminal.com/letme/index.md\n\n## Similar tools\n\nRanked by shared capabilities, then score. Same-category tools with no shared capability key are listed last.\n\n| Tool | Grade | Score | Rank | Shared capabilities | x402 | Markdown |\n| --- | --- | --- | --- | --- | --- | --- |\n| Robocorp | B | 65.5 | 337 | desktop.rpa, desktop.control, desktop.orchestration | no | https://www.anchorterminal.com/tools/robocorp.md |\n| Automation Anywhere | D | 50.9 | 815 | desktop.rpa, desktop.orchestration, desktop.control | no | https://www.anchorterminal.com/tools/automation-anywhere.md |\n| Robot Framework | BB | 76.4 | 35 | desktop.rpa | no | https://www.anchorterminal.com/tools/robot-framework.md |\n| AutoHotkey | D | 52.8 | 771 | desktop.control | no | https://www.anchorterminal.com/tools/autohotkey.md |\n| AutoIt | D | 46.3 | 913 | desktop.control | no | https://www.anchorterminal.com/tools/autoit.md |\n\n## Panel reviews (0)\n\nReviewed by the Anchor panel (https://www.anchorterminal.com/reviewers/index.md): .\n\nDesk reviews, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. For a desk review, the outcome says whether the reviewer's questions could be answered from public material: success, partial or failure. How reviews work: https://www.anchorterminal.com/reviews/how-it-works.md\n\n## Notable\n\n- Seven MCP server types in Orchestrator. UiPath, Remote, Command, Coded and Self-Hosted, with Platform and Swagger servers in preview since 17 September 2026 (source: \u003chttps://docs.uipath.com/orchestrator/automation-cloud/latest/user-guide/about-mcp-servers.md\u003e)\n- Every MCP request must carry a bearer token. PATs need OR.Execution to list tools and OR.Jobs to run them, because tools call ListReleases and StartJobs (source: \u003chttps://docs.uipath.com/orchestrator/automation-cloud/latest/user-guide/authenticating-with-a-personal-access-token.md\u003e)\n- GET /odata/Jobs and GET /odata/QueueItems are limited to 100 requests a minute per tenant from integrations and 1,000 from automations. Starting jobs and adding queue items are not limited (source: \u003chttps://docs.uipath.com/orchestrator/automation-cloud/latest/api-guide/rate-limits.md\u003e)\n- The Orchestrator API specification is OpenAPI 3.0. The Swagger 2.0 version was deprecated in August 2026 and removed from Automation Cloud in September 2026 (source: \u003chttps://docs.uipath.com/orchestrator/automation-cloud/latest/api-guide/read-me.md\u003e)\n- Status history lists robot job failures in Europe from 10:00 to 17:23 UTC on 10 September 2026 and an expired certificate affecting several ML services in multiple regions on 13 October 2026 (source: \u003chttps://status.uipath.com/history.rss\u003e)\n- The Python SDK `uipath` reached 2.14.37 on 12 October 2026, its eighth release since 1 October (source: \u003chttps://pypi.org/pypi/uipath/json\u003e)\n\n- #2 of 6 in Best desktop and mobile app automation for AI agents: https://www.anchorterminal.com/best/desktop-automation/index.md\n- All 15 desktop comparisons: https://www.anchorterminal.com/compare/desktop-automation/index.md\n\n## Compare\n\n- [AutoHotkey vs UiPath](https://www.anchorterminal.com/compare/autohotkey-vs-uipath.md): D 52.8 vs B 68.2\n- [AutoIt vs UiPath](https://www.anchorterminal.com/compare/autoit-vs-uipath.md): D 46.3 vs B 68.2\n- [Automation Anywhere vs UiPath](https://www.anchorterminal.com/compare/automation-anywhere-vs-uipath.md): D 50.9 vs B 68.2\n- [Robocorp vs UiPath](https://www.anchorterminal.com/compare/robocorp-vs-uipath.md): B 65.5 vs B 68.2\n- [Robot Framework vs UiPath](https://www.anchorterminal.com/compare/robot-framework-vs-uipath.md): BB 76.4 vs B 68.2\n\n## Verify this listing\n\nFor the vendor. The badge or a plain link to this page verifies the listing, from a page on uipath.com or one of its subdomains. It shows the listing is the vendor's and that the vendor knows it's here, and it never changes a grade, rank or review. The vendor sends the page's address to `POST https://www.anchorterminal.com/api/v1/verify` as `{\"slug\": \"uipath\", \"url\": \"…\"}`, or calls the `verify_listing` tool at https://www.anchorterminal.com/mcp. We fetch the page once, then again every week; two failed checks in a row and the verification lapses, and a later pass restores it. What we check: https://www.anchorterminal.com/builders/index.md#verify\n\nHTML badge:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/uipath\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/uipath.svg\" alt=\"UiPath on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e\n```\n\nMarkdown badge, for a README:\n\n```markdown\n[![UiPath on Anchor Terminal](https://www.anchorterminal.com/badges/uipath.svg)](https://www.anchorterminal.com/tools/uipath)\n```\n\nPlain link:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/uipath\"\u003eUiPath on Anchor Terminal\u003c/a\u003e\n```\n\n## Share this listing\n\nFor the vendor. Sharing assets for social media, two PNGs of 1200 × 630 that say UiPath is listed on Anchor Terminal, with the vendor's logo and this page's address and no grade or score.\n\n- Dark: https://www.anchorterminal.com/assets/share/uipath-dark.png\n- Light: https://www.anchorterminal.com/assets/share/uipath-light.png\n- Create a video and download its frames: https://www.anchorterminal.com/assets/listing-video/index.html?listing=uipath\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-14", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Terminal", "url": "https://www.anchorterminal.com/tools/" }, { "name": "Desktop \u0026 mobile app control", "url": "https://www.anchorterminal.com/categories/desktop-automation" }, { "name": "UiPath", "url": "" } ], "description": "UiPath is a robotic process automation platform whose hosted Orchestrator runs robots that operate desktop, web and Windows applications. Outside agents start and monitor jobs through the Orchestrator API or folder-scoped MCP servers in Automation Cloud.", "facts": [ "rank #237 of 1076", "OAuth auth", "0 desk reviews" ], "h1": "UiPath", "image": "https://www.anchorterminal.com/assets/og/tools-uipath.png", "path": "/tools/uipath", "published": "2026-10-01", "section": "tools", "title": "UiPath review (2026): pricing, alternatives and grade B", "toc": null, "updated": "2026-10-14", "url": "https://www.anchorterminal.com/tools/uipath" }, "tokens": { "markdown": 6700, "slim": 1730 }, "version": 1 }