UiPath MCP servers in Orchestrator: access, read/write and how to connect

UiPath hosts MCP servers in Orchestrator that turn your automations into tools. Running a tool executes the process. OAuth or a token, remote URL. Verified 21 Oct 2026.

Official MCP servers in Orchestrator · read & write, depending on the automations you expose

Hosting: Remote, per server: https://cloud.uipath.com/{org}/{tenant}/agenthub_/mcp/{folderKey}/{slug}. Seven types; UiPath and Platform run on UiPath, Command and Coded on UiPath Serverless, Self-Hosted on your infrastructure, Remote and Swagger point at external tools
Auth: MCP OAuth flow for interactive clients; personal access token, external application or interactive CLI login as alternatives
Read / write: Depends on what you expose. Listing tools only reads. Running a tool executes the underlying process, agent, API workflow or activity
Works with: Any MCP client that follows the MCP authorization spec; UiPath names VS Code, GitHub Copilot, Copilot Studio and ChatGPT. Claude isn't on that list
Plan requirement: UiPath Automation Cloud with Orchestrator. Dedicated lists only the UiPath and Remote types (Platform, Swagger and Self-Hosted aren't in UiPath's availability table); Public Sector has none
Last changed: 2026: MCP server types and the MCP OAuth flow documented in Orchestrator
Verification: Verified 21 Oct 2026 by theFinanceStack · confidence: high

What can an agent do with UiPath through MCP?

It can list and run the tools an Orchestrator admin has put on a UiPath MCP server. That means the automations, agents and APIs you chose to expose, and nothing else.

UiPath documents seven server types. There is no fixed tool count.

Server types

Server type	What it exposes or runs
UiPath	Artifacts you pick in Orchestrator: RPA processes, agents, Maestro BPMN processes, API workflows and Integration Service activities
Platform (preview)	Operations from a UiPath service such as Test Manager
Swagger (preview)	Tools generated from an OpenAPI document
Remote	An external MCP server, brought under UiPath governance
Command, Coded and Self-Hosted	MCP packages or custom Python servers. Coded and Command servers execute Orchestrator jobs.

Every run is live

UiPath says listing tools needs OR.Execution and running them needs OR.Jobs.
A tool call does whatever the automation behind it does.
If a process posts invoices to an ERP, approves a payment run or calls a payment provider (a Remote server example UiPath gives), the agent can trigger it.
UiPath doesn't document a per-tool read-only flag.

Can

List the tools on a server you can see (needs MCPServers.View in that folder)
Run exposed RPA processes, agents, Maestro BPMN processes and API workflows
Call Integration Service activities (needs OAuth or interactive login; a token won't work)
Call operations of a UiPath service such as Test Manager (Platform type, preview)
Call an OpenAPI-described API (Swagger type, preview) or an external MCP server (Remote type)

Cannot

Reach anything an admin hasn't added to the server; tools are chosen one by one in Orchestrator (per UiPath)
Use a token for one server on another server, except from clients without resource binding such as Copilot (per UiPath)
Run Integration Service-backed tools with a personal access token or client credentials; those calls time out (per UiPath)
Use Coded or Command servers on Automation Cloud Dedicated, which lists only UiPath and Remote types, or any MCP server type in Public Sector (per UiPath). Platform, Swagger and Self-Hosted aren't in UiPath's availability table

What access does it get?

The signed-in user's own Orchestrator rights in the server's folder, with OR.Execution to list tools and OR.Jobs to run them; UiPath documents both scope names.

Where	Scopes and permissions (as documented)	Admin requirement
Any MCP server type via MCP OAuth (interactive clients)	Scopes come from the server's Protected Resource Metadata; you sign in to UiPath Cloud and consent. Tokens are bound to that server (RFC 8707). Consent-screen scope names not documented by the vendor.	MCPServers.View in the folder (Automation User, Automation Developer or Folder Administrator). The AI Trust Layer policy mcp-dynamic-clients must be true, or sign-in is blocked; admins can allow-list callback domains.
Personal access token	OR.Execution (list tools) and OR.Jobs (run tools) from the Orchestrator resource; expiry up to one year	Same folder roles; Coded and Command servers also need Jobs.Create (in Automation User and Automation Developer)
External application (Admin › External Apps)	OR.Execution and OR.Jobs, plus OR.Default requested at token time to control routing	An organization admin creates the app; UiPath suggests it for unattended callers and third-party apps such as ChatGPT

How do I connect it?

An Orchestrator user creates the server under MCP Servers › Add MCP Server, copies its URL, and each person adds that URL to their client and signs in to UiPath Cloud.

In Orchestrator: MCP Servers › Add MCP Server, pick a type, name it, add only the tools you need and copy the Preview URL.
An admin sets mcp-dynamic-clients to true in AI Trust Layer governance. If your org allow-lists callback domains, add claude.ai, where Claude's hosted apps receive the sign-in callback (/api/mcp/auth_callback, per Claude's connector docs).
In Claude: Customize › Connectors › Add custom connector, paste the URL and sign in to UiPath Cloud.
Team/Enterprise: an Owner adds the connector.

UiPath doesn't name Claude in its MCP docs or publish a Claude directory listing as of 21 Oct 2026; a custom connector uses UiPath's standard MCP OAuth flow.

What should a finance team watch for?

Every tool is a live automation. Your main control is which processes you put on the server and who can call them.

Tool runs are live, with no draft step, and UiPath's MCP docs describe no approval step per tool call. A process that posts journals, releases payments or approves bills can be started from chat. Keep money-moving processes off agent-facing servers and keep approval on in the client: in Claude, don't set UiPath tools to always allow; in Claude Code, leave them off the allow list; in ChatGPT developer mode, confirm each write action.
You set least privilege in Orchestrator: one server per use case, only the tools needed. UiPath says a PAT's access is the intersection of its scopes and the user's folder role, so the real control is who holds Automation User or Jobs.Create in that folder. A PAT needs only OR.Execution and OR.Jobs; give it a short expiry.
Copilot lacks resource binding, so one sign-in there reaches every MCP server in the tenant, per UiPath.
Invoice text, emails, queue items and API responses are untrusted: an injected instruction could push the agent to run a posting or payment process.
A PAT pasted into a client config sits in plain text, often in a synced folder; don't commit it, and prefer OAuth. UiPath says a PAT lasts up to one year, acts as the user who created it and stops working when that user is deactivated. For shared or unattended callers, use an external application instead.
UiPath's MCP docs don't say how tool runs are billed. Each run of a UiPath, Coded or Command tool starts an Orchestrator job, so ask UiPath how runs count against your robot, agent or consumption licences before you open a server to many users.
UiPath's MCP pages make no data-handling statement for external clients; check UiPath's and your AI provider's terms. For external code UiPath advises a trusted provider.

How could finance teams and accounting firms use it?

Read-style tools suit questions and reports. Tools that change systems fit drafting runs, with a person reviewing before anything posts.

Inside a company

Run an existing report-extraction bot, such as an aged-payables pull, from chat instead of the Orchestrator console.
Ask an agent to start an invoice-capture process that drafts bills for review. Keep processes that post bills off the server.
Trigger an existing bank-reconciliation bot in a test folder and review its exception output before running it in production at close.
Expose an internal API through a Swagger server (preview) so analysts can query it in plain language.

At an accounting firm

Give staff a chat front end to existing client-onboarding or document-collection bots.
Keep one folder and server per client so an engagement team only reaches that client's automations. Clients without resource binding, such as Microsoft Copilot, get one sign-in that reaches every MCP server in the tenant (per UiPath), so folder roles do the separating; use a separate tenant where isolation matters.
Run data-gathering processes for a review, then have a person check the output before it reaches the client's ledger.

Whatever the use, a person approves any run that changes the ledger or another system of record.

Want UiPath connected to Claude for your team?

We configure scoped connections and a review step before anything changes your books. Fixed fee.

Book a 30-minute setup call

Change log

Date	Change	Source
2026-10-21	Re-verified: seven server types (Platform and Swagger in preview), OR.Execution and OR.Jobs scopes, MCP OAuth with mcp-dynamic-clients policy, regional availability	docs.uipath.com/orchestrator/automation-cloud/latest/user-gu
2026	UiPath MCP server types documented in Orchestrator (dataset last_changed_date)	docs.uipath.com/orchestrator/automation-cloud/latest/user-gu

FAQ

Is this official?

Yes. MCP servers are a built-in Orchestrator feature documented by UiPath. There is no UiPath listing in the Claude or ChatGPT directories as of 21 Oct 2026.

Is it free?

UiPath's MCP docs don't state a price or say how runs are billed. It needs Automation Cloud with Orchestrator, and each run of a UiPath, Coded or Command tool starts an Orchestrator job, so ask UiPath how runs count against your licences.

Does it change data in UiPath?

It can. Running a tool executes the process, agent or API workflow behind it, so it changes whatever that automation changes, in UiPath or in your finance systems.

Is my data used to train models?

UiPath's MCP docs don't address training or retention for external clients. Check UiPath's terms and your AI provider's terms.

Can my accountant use it on my behalf?

UiPath doesn't document delegated access. Each caller authenticates as themselves, so an accountant needs a UiPath user with a role in the server's folder.

Something wrong or out of date? Tell us and we'll email you when it's fixed.

Sources

Verified by theFinanceStack, 21 Oct 2026. Vendor list on the CFO Software Market Map courtesy of Jason Staats; AI connectivity data by theFinanceStack. Not tax, compliance or financial advice.