Uipath Orchestrator (MrAk47Anand007) MCP Server
uipath-orchestrator-mcp
npm
v0.1.1
Published by mrak47anand007 — no publish provenance, so origin is unverified, but the source is public: the repository link below is self-declared yet readable, so you can inspect the code before adopting it.
The grade answers one question — how safe is this server for you to adopt — so it is computed in two auditable stages. Nothing below is an opinion or an LLM's guess; every line is a real term the deterministic engine applied, and the same input always yields the same number.
1. Threat score — 100 − 0 = 100. What the published surface and source actually contain:
The deterministic scan raised no scored threat in the surface it inspected — the threat score stayed at 100. Capability observations and advisory notes are recorded but never lower it.
2. Client adoption risk — 100 − 11 = 89. Three small, subtract-only factors that reflect your risk in adopting it — a clean scan proves less on a powerful, unverified or barely-inspectable package, so the grade says so plainly:
| Points | Adoption-risk factor |
|---|---|
| −10 | capability blast radius (critical) — client exposure if the model is manipulated |
| −1 | publisher verification (public source) — no provenance, but the source is public and inspectable |
| ✓ | inspection depth (source) — how much of the target the scan could see |
Capability observations and info notes are shown under Findings but never scored.
Open any row's finding below for the file, line and evidence behind a deduction.
Findings 7
critical Completed toxic-flow trifecta across toolsMTC-FLOW-002
This server (without client built-ins) exposes a complete data-exfiltration chain: uipath_get_bucket_read_uri → uipath_delete_bucket_file → uipath_create_webhook. Untrusted input is ingested, private data is read, and it can be sent to an external sink via the agent composing the tools (→). Static analysis proves the primitive exists, not that a specific run will occur.
Fix: Remove one leg of the trifecta: isolate untrusted-input tools from secret-reading tools and from egress tools, or require human approval between them.
Location: flow uipath_get_bucket_read_uri → uipath_delete_bucket_file → uipath_create_webhook
high Shell/command execution in server code (dist/src/cli.js)MTC-SRC-002
In the server's implementation (`dist/src/cli.js:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: child_process
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server dist/src/cli.js
high Shell/command execution in server code (dist/src/setup/secure-storage.js)MTC-SRC-002
In the server's implementation (`dist/src/setup/secure-storage.js:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: child_process
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server dist/src/setup/secure-storage.js
low Unconstrained path parameter "path" on "uipath_read_bucket_file"MTC-CAP-008
Tool "uipath_read_bucket_file" takes a path parameter "path" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.
Fix: Resolve and verify the path stays within an allowed root; reject traversal sequences.
Location: tool uipath_read_bucket_file · inputSchema.properties.path
low Unconstrained path parameter "directory" on "uipath_list_bucket_files"MTC-CAP-008
Tool "uipath_list_bucket_files" takes a path parameter "directory" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.
Fix: Resolve and verify the path stays within an allowed root; reject traversal sequences.
Location: tool uipath_list_bucket_files · inputSchema.properties.directory
low Unconstrained path parameter "path" on "uipath_get_bucket_read_uri"MTC-CAP-008
Tool "uipath_get_bucket_read_uri" takes a path parameter "path" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.
Fix: Resolve and verify the path stays within an allowed root; reject traversal sequences.
Location: tool uipath_get_bucket_read_uri · inputSchema.properties.path
low Unconstrained path parameter "path" on "uipath_delete_bucket_file"MTC-CAP-008
Tool "uipath_delete_bucket_file" takes a path parameter "path" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.
Fix: Resolve and verify the path stays within an allowed root; reject traversal sequences.
Location: tool uipath_delete_bucket_file · inputSchema.properties.path
Tools 132 statically extracted from source — tags show each tool’s reach
uipath_get_bucket_read_uriingests untrusted inputreads sensitive datauipath_create_webhooknetwork egressuipath_delete_bucket_filereads sensitive datauipath_delete_webhooknetwork egressuipath_get_job_detailsingests untrusted inputuipath_get_job_trigger_payloadingests untrusted inputuipath_get_role_user_idsingests untrusted inputuipath_get_webhooknetwork egressuipath_list_bucket_filesreads sensitive datauipath_list_webhook_event_typesnetwork egressuipath_list_webhooksnetwork egressuipath_ping_webhooknetwork egressuipath_read_bucket_filereads sensitive datauipath_trigger_custom_webhook_eventnetwork egressuipath_update_webhooknetwork egressuipath_add_queue_itemno sensitive capabilityuipath_add_queue_items_bulkno sensitive capabilityuipath_assign_roles_to_userno sensitive capabilityuipath_assign_users_to_foldersno sensitive capabilityuipath_calendar_existsno sensitive capabilityuipath_complete_generic_taskno sensitive capabilityuipath_create_assetno sensitive capabilityuipath_create_calendarno sensitive capabilityuipath_create_external_job_triggerno sensitive capabilityuipath_create_generic_taskno sensitive capabilityuipath_create_queue_definitionno sensitive capabilityuipath_create_queue_item_commentno sensitive capabilityuipath_create_releaseno sensitive capabilityuipath_create_scheduleno sensitive capabilityuipath_create_task_noteno sensitive capabilityuipath_dashboard_summaryno sensitive capabilityuipath_delete_calendarno sensitive capabilityuipath_delete_inactive_unattended_sessionsno sensitive capabilityuipath_delete_process_packageno sensitive capabilityuipath_delete_queue_definitionno sensitive capabilityuipath_delete_queue_item_commentno sensitive capabilityuipath_delete_releaseno sensitive capabilityuipath_delete_scheduleno sensitive capabilityuipath_deliver_job_trigger_payloadno sensitive capabilityuipath_export_audit_logsno sensitive capabilityuipath_get_asset_by_nameno sensitive capabilityuipath_get_asset_valueno sensitive capabilityuipath_get_assigned_machinesno sensitive capabilityuipath_get_audit_log_detailsno sensitive capabilityuipath_get_calendarno sensitive capabilityuipath_get_current_permissionsno sensitive capabilityuipath_get_current_userno sensitive capabilityuipath_get_directory_permissionsno sensitive capabilityuipath_get_error_logsno sensitive capabilityuipath_get_faulted_jobsno sensitive capabilityuipath_get_folder_machine_session_runtimesno sensitive capabilityuipath_get_folder_runtimesno sensitive capabilityuipath_get_generic_task_datano sensitive capabilityuipath_get_job_trigger_wait_eventsno sensitive capabilityuipath_get_job_triggers_by_job_keyno sensitive capabilityuipath_get_jobs_statsno sensitive capabilityuipath_get_machineno sensitive capabilityuipath_get_machine_session_runtimesno sensitive capabilityuipath_get_queue_definitionno sensitive capabilityuipath_get_queue_definition_by_keyno sensitive capabilityuipath_get_queue_item_comments_historyno sensitive capabilityuipath_get_queue_item_events_historyno sensitive capabilityuipath_get_queue_item_processing_historyno sensitive capabilityuipath_get_queue_processing_recordsno sensitive capabilityuipath_get_queues_processing_statusno sensitive capabilityuipath_get_releaseno sensitive capabilityuipath_get_robot_log_total_countno sensitive capabilityuipath_get_robot_statsno sensitive capabilityuipath_get_running_jobsno sensitive capabilityuipath_get_statusno sensitive capabilityuipath_get_taskno sensitive capabilityuipath_get_task_by_keyno sensitive capabilityuipath_get_task_permissionsno sensitive capabilityuipath_get_task_usersno sensitive capabilityuipath_get_unread_alert_countno sensitive capabilityuipath_get_userno sensitive capabilityuipath_get_user_by_keyno sensitive capabilityuipath_get_user_folder_rolesno sensitive capabilityuipath_get_users_for_roleno sensitive capabilityuipath_health_checkno sensitive capabilityuipath_list_alertsno sensitive capabilityuipath_list_assetsno sensitive capabilityuipath_list_audit_logsno sensitive capabilityuipath_list_bucketsno sensitive capabilityuipath_list_calendarsno sensitive capabilityuipath_list_execution_mediano sensitive capabilityuipath_list_folder_usersno sensitive capabilityuipath_list_foldersno sensitive capabilityuipath_list_job_triggersno sensitive capabilityuipath_list_machinesno sensitive capabilityuipath_list_processesno sensitive capabilityuipath_list_queue_definitionsno sensitive capabilityuipath_list_queue_item_commentsno sensitive capabilityuipath_list_queue_item_eventsno sensitive capabilityuipath_list_queue_itemsno sensitive capabilityuipath_list_releasesno sensitive capabilityuipath_list_robot_logsno sensitive capabilityuipath_list_robot_sessionsno sensitive capabilityuipath_list_robotsno sensitive capabilityuipath_list_rolesno sensitive capabilityuipath_list_schedulesno sensitive capabilityuipath_list_task_activitiesno sensitive capabilityuipath_list_task_notesno sensitive capabilityuipath_list_tasksno sensitive capabilityuipath_list_tasks_across_foldersno sensitive capabilityuipath_list_usersno sensitive capabilityuipath_mark_alerts_as_readno sensitive capabilityuipath_raise_process_alertno sensitive capabilityuipath_restart_jobno sensitive capabilityuipath_resume_jobno sensitive capabilityuipath_rollback_releaseno sensitive capabilityuipath_save_and_reassign_generic_taskno sensitive capabilityuipath_save_generic_task_datano sensitive capabilityuipath_search_directory_objectsno sensitive capabilityuipath_search_foldersno sensitive capabilityuipath_set_queue_item_progressno sensitive capabilityuipath_set_schedule_enabledno sensitive capabilityuipath_start_jobno sensitive capabilityuipath_stop_jobno sensitive capabilityuipath_toggle_robot_enabled_statusno sensitive capabilityuipath_toggle_user_roleno sensitive capabilityuipath_update_assetno sensitive capabilityuipath_update_calendarno sensitive capabilityuipath_update_machines_to_folder_associationsno sensitive capabilityuipath_update_queue_definitionno sensitive capabilityuipath_update_queue_item_commentno sensitive capabilityuipath_update_releaseno sensitive capabilityuipath_update_release_to_latest_packageno sensitive capabilityuipath_update_release_to_specific_packageno sensitive capabilityuipath_upload_bucket_fileno sensitive capabilityuipath_upload_process_packageno sensitive capabilityuipath_validate_usersno sensitive capability
Toxic flows 1
Cross-tool combinations that form a data-exfiltration primitive (untrusted input → sensitive source → external sink).
What this scan could not see
- Tools were statically extracted from the published source (132 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".
Versions
Scan history per published version. The engine is deterministic — the same version always yields the same score, so a changed score means the package itself changed.
| Version | Score | Findings | Engine | Scanned |
|---|---|---|---|---|
v0.1.1 latest |
B 89/100 | 7 | 1.8.0 | 2026-07-23 |
Embed this score
Show this server's live Trust Score in your README, docs or website. The badge is served straight from the registry and updates automatically after every rescan — no API key needed. It links back to this page, so anyone who sees the grade can also read the findings behind it instead of taking a number on faith.
Verify this score yourself
The score above is reproducible: the same package version always yields the same result. Run it locally or over the free API — no account, no LLM, fully deterministic.
npx mcptrustchecker scan uipath-orchestrator-mcp --onlineOther implementations of Uipath Orchestrator 1
Independent packages implementing the same tool, scanned with the same engine. Compare all 2 side by side →
More in Business & CRM
Security scan results for the Agentgate Ucp MCP server.
Security scan results for the Autotask MCP server.
Security scan results for the B2c Dx MCP server.
Security scan results for the Brreg MCP server.
Security scan results for the Canlii MCP server.
Security scan results for the Ch Environmental Compliance MCP server.