# UiPath > UiPath is a robotic process automation platform whose hosted Orchestrator runs robots that operate desktop, web and Windows applications. Outside agents start and monitor jobs through the Orchestrator API or folder-scoped MCP servers in Automation Cloud. - Canonical: https://www.anchorterminal.com/tools/uipath - Markdown: https://www.anchorterminal.com/tools/uipath.md (~6,700 tokens) - Slim: https://www.anchorterminal.com/tools/uipath.min.md (~1,730 tokens, same facts, less prose, for token-sensitive contexts) - JSON: https://www.anchorterminal.com/tools/uipath.json (this page as data, same URL with Accept: application/json) - Site index for agents: https://www.anchorterminal.com/llms.txt (full text: https://www.anchorterminal.com/llms-full.txt) - API: https://www.anchorterminal.com/api/v1/index.json - Updated: 2026-10-14 ## Overview **Grade B · 68.2/100 · rank #237 of 1076 · #2 in Desktop & mobile app control · not agent-ready · confidence medium** ## Assessment Orchestrator exposes published RPA workflows, agents and API workflows as MCP tools over Streamable HTTP, with MCP OAuth, scoped PATs and an OpenAPI 3.0 API. Prices above the $25 Basic plan need a sales conversation, and the status page logged several multi-hour incidents between 10 September and 13 October 2026. ## Facts | Field | Value | | --- | --- | | Vendor | UiPath (https://www.uipath.com) | | Kind | HTTP API | | Category | Desktop & mobile app control (https://www.anchorterminal.com/categories/desktop-automation) | | Transport | HTTP | | Endpoint | `https://cloud.uipath.com/{org}/{tenant}/agenthub_/mcp/{folderKey}/{slug}` | | Auth | OAuth · OAuth 2.0 throughout. MCP servers take a bearer token on every request from four sources. The MCP OAuth flow (authorisation server discovery, Client ID Metadata Documents or dynamic client registration, tokens bound to one server by RFC 8707 resource indicators, gated by an AI Trust Layer policy that is off unless an administrator enables it). Personal access tokens with chosen Orchestrator scopes and a lifetime of up to one year. External applications using client credentials (the only unattended route) or user scopes with PKCE. Interactive login through `uipath auth`, with one-hour tokens. The caller needs `MCPServers.View` in the folder, and Coded and Command servers also need `Jobs.Create`. Access is the intersection of token scopes and folder roles. | | Pricing | Freemium ($25 / mo) · The Community plan is free with no time limit, by direct sign-up, with one tenant, one Pro and one Plus user, one Unattended Robot and a monthly Credits pool. Basic starts at $25 a month with two robots and limited agent calls, hosted in Europe. Standard (60-day free trial) and Enterprise are priced by sales, and user and robot licences are sold across tiers without published prices. Whether a card is needed for Community was not stated (checked 2026-10-14). | | x402 | No · No x402, MPP or L402 in the Orchestrator API guide, the MCP server pages or the pricing page (checked 2026-10-14). | | Licence | Proprietary service under the UiPath Master Software and Services Agreement, the Community Agreement for the free plan | | Packages | pypi: `uipath` | | Docs | https://docs.uipath.com/orchestrator/automation-cloud/latest/user-guide/about-mcp-servers | | llms.txt | https://docs.uipath.com/llms.txt | | Last release | 2026-10-12 | | Interfaces | Orchestrator API (OData, OpenAPI 3.0 at {AutomationCloudURL}/{org}/{tenant}/orchestrator_/swagger/index.html) and MCP servers over Streamable HTTP at https://cloud.uipath.com/{org}/{tenant}/agenthub_/mcp/{folderKey}/{slug} | | MCP server types | UiPath (exposes published RPA workflows, agents, API workflows, Maestro BPMN processes and Integration Service activities), Remote, Command, Coded, Self-Hosted. Platform and Swagger types in preview | | Starting a run | POST /odata/Jobs/UiPath.Server.Configuration.OData.StartJobs with a folder header, input arguments up to 10,000 characters of JSON. API triggers start a job from a custom URL with a PAT or OAuth (https://docs.uipath.com/orchestrator/automation-cloud/latest/api-guide/jobs-requests.md) | | Credentials | MCP OAuth flow, personal access tokens (up to one year), external applications (client credentials, user scopes, PKCE), interactive login through the UiPath CLI | | Rate limits | 100 requests a minute per tenant for GET Jobs and QueueItems from integrations, 1,000 from automations, 100 a day per tenant for export endpoints. 429 responses carry Retry-After and X-RateLimit-Remaining | | Errors | HTTP status codes plus a table of custom error codes such as 1001 NameAlreadyUsed and 1002 ItemNotFound (https://docs.uipath.com/orchestrator/automation-cloud/latest/api-guide/response-codes.md) | | Audit | Orchestrator audit logs and an API audit view of GetAll Jobs and QueueItems calls over 30 days (preview). Personal Workspace changes added to audit logs on 12 October 2026 | | Free tier | Community plan, free with no time limit, one Pro and one Plus user, one Unattended Robot and a monthly Credits pool, under the Community Agreement of 27 July 2026 | | Platforms | Robots run Windows desktop, web and other applications on the customer's machines or UiPath Cloud Robots. Automation Cloud is hosted in eight regions according to the product page | | Docs for agents | https://docs.uipath.com/llms.txt indexes every product, and any docs page returns Markdown when .md is added to its URL | | Capabilities | desktop.rpa, desktop.orchestration, desktop.control | | Tags | hosted, official, oauth, enterprise, odata, mcp, python, closed-source, audit-log, freemium, llms-txt, webhooks | | JSON | https://www.anchorterminal.com/api/v1/tools/uipath.json | ## Score breakdown (methodology v0.4, October 2026 research run) Assessed 2026-10-14 from public evidence against the published checklist (https://www.anchorterminal.com/benchmark/#checklist). Confidence: medium. Performance and Task success pending (no score, not in the total); the total is Σ(score × weight) ÷ 80 over the 7 assessed categories. "This run" is each category's share of the 100 points. | Category | Weight | This run | Score (0–100) | Points | | --- | --- | --- | --- | --- | | Reliability | 16% | 20 | 62 | 12.4 | | Performance | 10% | pending | pending | n/a | | Schema & documentation | 13% | 16.2 | 79 | 12.8 | | Agent ergonomics | 13% | 16.2 | 73 | 11.9 | | Security & auth | 14% | 17.5 | 82 | 14.3 | | Payments & pricing | 10% | 12.5 | 25 | 3.1 | | Task success | 10% | pending | pending | n/a | | Maintenance & community | 7% | 8.8 | 80 | 7.0 | | Transparency & trust (editorial 57, provenance 94) | 7% | 8.8 | 76 | 6.7 | | Negative events | up to −15 | up to −15 | none recorded | 0 | | **Total** | | | | **68.2 → B** | ### Why each score - Reliability 62: Graded on the hosted Orchestrator API and MCP servers. Public Atlassian Statuspage at status.uipath.com with component and incident history (20). The 90-day feed has several major incidents, including robot job failures in Europe from 10:00 to 17:23 UTC on 10 September 2026, solution deployments failing from 15:18 to 20:45 UTC on 11 September, Cloud Robot jobs stuck pending in the US for 94 minutes on 2 October and an expired certificate taking down several ML services across regions on 13 October (0). Per-endpoint rate limits with numbers (15). 429 responses carry Retry-After and X-RateLimit-Remaining, with retry guidance. No idempotency key for StartJobs was found (12 of 15). The Automation Cloud page states a 99.9 per cent uptime SLA, but the SLA document with credits was not found publicly (5 of 10). The Orchestrator API and the UiPath MCP server type are generally available, with Platform and Swagger servers in preview (10). - Performance: Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes. - Schema & documentation 79: The Orchestrator API is described in OpenAPI 3.0, served per tenant at the Orchestrator URL plus /swagger/index.html rather than as a public file (20 of 25). llms.txt at docs.uipath.com and a Markdown copy of every page by adding .md (10). API pages state scope and limits clearly, such as which fields GET /odata/Jobs omits. MCP tool descriptions come from the description of each published artifact, so quality depends on the owner (12 of 20). OData types and an enumerated types reference. MCP tool inputs follow each process's arguments (11 of 15). Request examples on each API page and a table of custom error codes (14 of 15). Monthly dated release notes. UiPath says the Swagger version number should not be relied on (12 of 15). - Agent ergonomics 73: An MCP server holds only the tools a person chose for one folder, and the API takes $select, $top and $expand (22 of 25). $filter, $orderby, $top and $count, with export endpoints for bulk reads (20). HTTP codes plus numbered custom errors such as 1002 ItemNotFound and 4502 for the daily export limit (16 of 20). No idempotency key for starting jobs, and no readOnlyHint or destructiveHint described for MCP tools (6 of 20). Every folder call needs a folder header and StartJobs needs a release key. A Python SDK and CLI exist; a second official SDK language was not confirmed (9 of 15). - Security & auth 82: MCP OAuth with resource indicators binding a token to one server, external apps with OAuth scopes such as OR.Jobs, and PATs with chosen scopes and an expiry of up to one year (30). Folder roles limit what a token can do, and automatic client registration is off until an administrator enables it in the AI Trust Layer. No approval step before destructive API calls was found (14 of 20). Tools return job outputs from robots that read third-party applications, and no prompt-injection guidance was found in the MCP pages (5 of 15). Orchestrator audit logs and a preview API audit view (13 of 15). security.txt valid until 2028 with a HackerOne programme, and SOC 2 Type 2, ISO/IEC 27001 and FedRAMP Moderate claimed on the Automation Cloud page (20). - Payments & pricing 25: No x402, MPP or L402 (0). Basic is published at $25 a month and the Community plan is free, while Standard, Enterprise and extra robots are priced by sales (10). The Community plan is free with no time limit by direct sign-up. No page we read says whether a card is needed (15 of 20). A person signs up in a browser and creates the PAT or external application (0). - Task success: Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored. - Maintenance & community 80: Orchestrator release notes dated 12 October 2026 (30). Entries on 5, 7 and 12 October and nine dates in September (20). Public dated release notes, a forum and a support portal. Support was not tested (12 of 15). The Python SDK `uipath` 2.14.37 was published on 12 October 2026. UiPath's MCP servers are not in the official MCP registry, where a search returned only a third-party server (12 of 15). The SDK's CI was not checked (6 of 10). - Transparency & trust 76: Closed service with published terms pages, though the MSSA that governs paid use is signed per customer and not public (15). The privacy policy covers cloud product data, says it may be used for product improvement and machine learning under the customer contract and warns against personal data on Community. The legal page dates it 30 November 2018, and the DPA download was not read (15 of 30). A product lifecycle policy and a dated deprecation timeline for the Swagger 2.0 specification (17 of 20). Hosting regions are named, such as Europe for Basic. No subprocessor list was read (10 of 20). Fix list for a coding agent, everything this grade says the listing lacks, the biggest gain first (13 items): https://www.anchorterminal.com/fixes/uipath.md (JSON https://www.anchorterminal.com/fixes/uipath.json) ### What we couldn't check - unchecked: the text of the Automation Cloud SLA and its service credits; only the 99.9 per cent claim on the product page and status page was read - unchecked: the Data Processing Agreement and a subprocessor list - unchecked: whether Community sign-up asks for a card - unchecked: the GitHub repository for the `uipath` Python SDK, which the GitHub API did not return, so CI and issue response were not assessed ### Sources - MCP server types: (seen 2026-10-14) - MCP server authentication and URL format: (seen 2026-10-14) - MCP OAuth flow: (seen 2026-10-14) - personal access tokens for MCP: (seen 2026-10-14) - rate limits: (seen 2026-10-14) - API specification read me and Swagger 2.0 deprecation: (seen 2026-10-14) - response codes: (seen 2026-10-14) - jobs requests and StartJobs: (seen 2026-10-14) - Orchestrator release notes, October 2026: (seen 2026-10-14) - Orchestrator release notes, September 2026: (seen 2026-10-14) - status incident history feed: (seen 2026-10-14) - pricing: (seen 2026-10-14) - Community plan: (seen 2026-10-14) - legal terms: (seen 2026-10-14) - privacy policy: (seen 2026-10-14) - Automation Cloud product page (certifications, SLA claim): (seen 2026-10-14) - security.txt: (seen 2026-10-14) - Python SDK on PyPI: (seen 2026-10-14) ## Who's behind it (provenance 94/100, checked 2026-10-14) | Check | Finding | Points | | --- | --- | --- | | Legal entity named | UiPath Inc. | 20/20 | | Domain age | uipath.com, registered 2011-10-26 (14 years) | 15/15 | | Endpoint on the vendor's domain | cloud.uipath.com | 15/15 | | Terms of service | published, but our reader couldn't read it | 7/10 | | Privacy policy | read, states 7 of the 8 things a reader expects, and has 1 clause that costs points | 7.3/10 | | Status page | status.uipath.com | 10/10 | | Changelog | published | 10/10 | | security.txt | valid | 10/10 | API and MCP endpoints answer on cloud.uipath.com. www.uipath.com/.well-known/security.txt names security@uipath.com and https://hackerone.com/uipath and expires on 2028-06-26. The legal terms page says paid products fall under the UiPath Master Software and Services Agreement signed with each customer, the Community plan under the Community Agreement (updated 27 July 2026) and trials and previews under the Master Evaluation Agreement (updated 12 June 2026). The MSSA itself is not public. The same page lists the privacy policy's last update as 30 November 2018. A Data Processing Agreement is published as a download, which we did not read. The legal entities named are UiPath SRL, Bucharest, and UiPath Inc., One Vanderbilt Ave., New York. status.uipath.com is an Atlassian Statuspage. Its robots.txt disallows /api/, so incident history was read from /history.rss. RDAP for uipath.com gives a registration date of 2011-10-26. ### Terms and privacy, as read A reading by a fixed set of rules, each answered with the vendor's own sentence. Not legal advice. **Terms of service** (https://www.uipath.com/legal/trust-and-security/legal-terms), read 2026-10-14. Our reader couldn't read it (the page is an index of UiPath's legal documents, not the terms themselves). - Also in the text (2026-10-14). Under AI Terms, the page lists the Anthropic Commercial Terms of Service as an end user agreement. "Anthropic: End User Agreement: Anthropic Commercial Terms of Service" **Privacy policy** (https://www.uipath.com/legal/trust-and-security/privacy-policy), read 2026-10-14, gives no date, states 7 of the 8 things a reader expects. - To know. Says it may use customer content to train or improve models, and no opt-out was found (costs points). "When you use UiPath’s cloud products, the data used with the products may be used for product improvement and machine learning purposes, based on the contract with our customers, to provide them with improved functionalities." - Not found in the text. Gives the date it was last updated. - Says how long data is kept. Names a period of 18 months. - Says whether personal data is sold or shared for advertising. Says it does not sell personal data. - Gives a privacy contact. dpo@uipath.com. - Says where data is transferred or stored. Relies on standard contractual clauses. - Also in the text (2026-10-14). Conversations with the agentic chat support on the website and Partner Portal are processed through sub-processors, including to improve future responses. "We process conversations through our sub-processors (such as Cloudflare Inc. or Tribble Inc.) in order to provide you with the functionality and to improve future responses." ## Live (updated 2026-10-14 09:42 UTC) - Right now: down, HTTP 500, 81 ms, checked 2026-10-14 09:42 UTC (get on `https://cloud.uipath.com/{org}/{tenant}/agenthub_/mcp/{folderKey}/{slug}`) - Uptime 24h 0.0% (17 probes) · 30 days 0.0% (17 probes) · p50 n/a · p95 n/a - Vendor status page: none, All Systems Operational - Always current: https://www.anchorterminal.com/api/v1/live/uipath.json ## Probe metrics Not measured yet. Our benchmark probes haven't run, so there's no availability, latency or error rate from a run and Performance is pending. Live uptime, where we poll the endpoint, is under Live and doesn't change the score. ## Prices | Item | Price | Unit | Note | | --- | --- | --- | --- | | Automation Cloud Basic | $25 | per month (plan) | starting price, up to 5 Basic, 5 Plus and 1 Pro user, 2 robots, limited agent calls, hosted in Europe | Across all listings: https://www.anchorterminal.com/prices/index.md ## Strengths - Folder-scoped MCP servers turn chosen processes, agents and API workflows into tools at a URL of the form cloud.uipath.com/{org}/{tenant}/agenthub_/mcp/{folderKey}/{slug} - MCP OAuth flow with Client ID Metadata Documents, dynamic registration and RFC 8707 resource binding, plus PATs scoped to OR.Jobs and OR.Execution - Rate limits published per endpoint, with Retry-After and X-RateLimit-Remaining headers on 429 responses - llms.txt index and a Markdown copy of every docs page by adding .md to the URL - security.txt valid until 2028 pointing to a HackerOne programme, and SOC 2 Type 2 and ISO/IEC 27001 claimed for Automation Cloud ## Weaknesses - Standard and Enterprise prices are not published, and robot licences are sold through sales - Status history shows robot job failures in Europe for over seven hours on 10 September 2026 and a certificate expiry hitting several services on 13 October 2026 - No idempotency key was found for StartJobs, and the MCP pages say nothing about readOnlyHint or destructiveHint - The OpenAPI document is served per tenant behind the Orchestrator URL, not as a public file - Tools backed by Integration Service activities time out with PATs or client credentials and need user-context sign-in ## Before you call it (notes for agents) 1. Send `Authorization: Bearer ` on every MCP request. The `mcp-session-id` header carries no authentication 2. Give a PAT both `OR.Execution` (list tools) and `OR.Jobs` (run tools), or tool listing or calls fail 3. Use client credentials from an external application for unattended runs. It is the only method that needs no person at sign-in 4. Add a folder header such as `X-UIPATH-FolderKey` to Orchestrator API calls on folder resources 5. Read job outputs with `GET /odata/Jobs({key})`. `GET /odata/Jobs` returns InputArguments and OutputArguments as null and is limited to 100 calls a minute per tenant ## Connect First request: ```bash curl -X POST "https://cloud.uipath.com/{org}/{tenant}/agenthub_/mcp/{folderKey}/{slug}" \ -H "Authorization: Bearer $UIPATH_PAT" \ -H "Content-Type: application/json" \ -d '{"jsonrpc":"2.0","method":"initialize","params":{...},"id":1}' ``` Through letme (picks today, calling later): https://letme.dev/uipath (letme picks it for desktop.control, the top-graded tool for the job, letme picks it for desktop.orchestration, the top-graded tool for the job). letme answers with the pick and how to call it direct; calling through letme (one key, the vendor's own price) comes later. How it works: https://www.anchorterminal.com/letme/index.md ## Similar tools Ranked by shared capabilities, then score. Same-category tools with no shared capability key are listed last. | Tool | Grade | Score | Rank | Shared capabilities | x402 | Markdown | | --- | --- | --- | --- | --- | --- | --- | | Robocorp | B | 65.5 | 337 | desktop.rpa, desktop.control, desktop.orchestration | no | https://www.anchorterminal.com/tools/robocorp.md | | Automation Anywhere | D | 50.9 | 815 | desktop.rpa, desktop.orchestration, desktop.control | no | https://www.anchorterminal.com/tools/automation-anywhere.md | | Robot Framework | BB | 76.4 | 35 | desktop.rpa | no | https://www.anchorterminal.com/tools/robot-framework.md | | AutoHotkey | D | 52.8 | 771 | desktop.control | no | https://www.anchorterminal.com/tools/autohotkey.md | | AutoIt | D | 46.3 | 913 | desktop.control | no | https://www.anchorterminal.com/tools/autoit.md | ## Panel reviews (0) Reviewed by the Anchor panel (https://www.anchorterminal.com/reviewers/index.md): . Desk reviews, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. For a desk review, the outcome says whether the reviewer's questions could be answered from public material: success, partial or failure. How reviews work: https://www.anchorterminal.com/reviews/how-it-works.md ## Notable - Seven MCP server types in Orchestrator. UiPath, Remote, Command, Coded and Self-Hosted, with Platform and Swagger servers in preview since 17 September 2026 (source: ) - Every MCP request must carry a bearer token. PATs need OR.Execution to list tools and OR.Jobs to run them, because tools call ListReleases and StartJobs (source: ) - GET /odata/Jobs and GET /odata/QueueItems are limited to 100 requests a minute per tenant from integrations and 1,000 from automations. Starting jobs and adding queue items are not limited (source: ) - The Orchestrator API specification is OpenAPI 3.0. The Swagger 2.0 version was deprecated in August 2026 and removed from Automation Cloud in September 2026 (source: ) - Status history lists robot job failures in Europe from 10:00 to 17:23 UTC on 10 September 2026 and an expired certificate affecting several ML services in multiple regions on 13 October 2026 (source: ) - The Python SDK `uipath` reached 2.14.37 on 12 October 2026, its eighth release since 1 October (source: ) - #2 of 6 in Best desktop and mobile app automation for AI agents: https://www.anchorterminal.com/best/desktop-automation/index.md - All 15 desktop comparisons: https://www.anchorterminal.com/compare/desktop-automation/index.md ## Compare - [AutoHotkey vs UiPath](https://www.anchorterminal.com/compare/autohotkey-vs-uipath.md): D 52.8 vs B 68.2 - [AutoIt vs UiPath](https://www.anchorterminal.com/compare/autoit-vs-uipath.md): D 46.3 vs B 68.2 - [Automation Anywhere vs UiPath](https://www.anchorterminal.com/compare/automation-anywhere-vs-uipath.md): D 50.9 vs B 68.2 - [Robocorp vs UiPath](https://www.anchorterminal.com/compare/robocorp-vs-uipath.md): B 65.5 vs B 68.2 - [Robot Framework vs UiPath](https://www.anchorterminal.com/compare/robot-framework-vs-uipath.md): BB 76.4 vs B 68.2 ## Verify this listing For the vendor. The badge or a plain link to this page verifies the listing, from a page on uipath.com or one of its subdomains. It shows the listing is the vendor's and that the vendor knows it's here, and it never changes a grade, rank or review. The vendor sends the page's address to `POST https://www.anchorterminal.com/api/v1/verify` as `{"slug": "uipath", "url": "…"}`, or calls the `verify_listing` tool at https://www.anchorterminal.com/mcp. We fetch the page once, then again every week; two failed checks in a row and the verification lapses, and a later pass restores it. What we check: https://www.anchorterminal.com/builders/index.md#verify HTML badge: ```html UiPath on Anchor Terminal ``` Markdown badge, for a README: ```markdown [![UiPath on Anchor Terminal](https://www.anchorterminal.com/badges/uipath.svg)](https://www.anchorterminal.com/tools/uipath) ``` Plain link: ```html UiPath on Anchor Terminal ``` ## Share this listing For the vendor. Sharing assets for social media, two PNGs of 1200 × 630 that say UiPath is listed on Anchor Terminal, with the vendor's logo and this page's address and no grade or score. - Dark: https://www.anchorterminal.com/assets/share/uipath-dark.png - Light: https://www.anchorterminal.com/assets/share/uipath-light.png - Create a video and download its frames: https://www.anchorterminal.com/assets/listing-video/index.html?listing=uipath