# MCP use cases and flows > Setup steps for connecting a public or private external tool to UiPath as a Remote MCP Server, and the authentication required for each. Many of the tools your agents need already exist somewhere else, maybe in a software running quietly inside your own infrastructure. A Remote MCP Server lets you bring any of these into UiPath as an MCP tool, so your agents can discover and call them the same way they use tools built natively on the platform and inheriting the UiPath platform governance features. How you connect depends on where the tool lives: * Directly, if it's already public on the internet. * Through [UiPath Relay](https://docs.uipath.com/automation-cloud/automation-cloud/latest/admin-guide/relay), if it lives inside your own network. This page walks through both, with the setup steps for each. For the other MCP Server types, UiPath, Coded, Command, and Self-Hosted, see [MCP Server types](https://docs.uipath.com/orchestrator/automation-cloud/latest/user-guide/mcp-server-types). ![Architecture overview showing the direct and Relay connection paths between Orchestrator and external MCP Servers](https://dev-assets.cms.uipath.com/assets/images/orchestrator/MCP-Connectivity-Architecture_sans_Platform_Swagger-619e37fb.webp) ## Use cases * **Bring a partner's API into your automations**: your team already has API access to a shipping carrier or a payment provider. As a Remote MCP Server, it's available to your agents directly, with no custom integration to build or maintain. * **Connect a SaaS tool your agents already need**: many popular platforms publish their own public MCP Server. Once it's added in Orchestrator, it's available to every agent and automation with access to that folder. * **Reach an internal system without exposing it to the internet**: your ticketing system or a legacy service runs inside your own data center and can't be published publicly. Through Relay, your agents can call its tools without a single inbound port opened. ## At a glance | | Use Case 1: Relay | Use Case 2: Direct | | --- | --- | --- | | Best for | Tools inside your own network or data center | Tools already reachable on the internet | | Extra setup | Relay Client installed and registered in your network | None beyond adding the MCP Server | | Inbound firewall changes | None, Relay keeps an outbound-only tunnel open | None | ## Use Case 1: External MCP via Relay + OAuth ### Request flow ![Architecture overview with highlighted flow for UiPath Internal MCP Client to Remote MCP to Relay](https://dev-assets.cms.uipath.com/assets/images/orchestrator/MCP-Connectivity-Architecture_sans_Platform_Swagger_Use_case-ef5d1aeb.webp) ### The scenario A tool your agents need, an ERP, a ticketing system, or a legacy service, runs inside your own network, behind a firewall, and isn't reachable from the public internet. You want your UiPath agents to call its tools the same way they call any other MCP Server in your catalog, without exposing it to the internet. Reachability and identity need to be addressed: * Reaching a host with no public route - solved via [UiPath Relay](https://docs.uipath.com/automation-cloud/automation-cloud/latest/admin-guide/relay) * Proving the caller's UiPath identity - solved via OAuth dynamic authentication The tool's own credential stays separate from both. If the tool is already reachable from the public internet, use **Use Case 2** instead as you don't need Relay. ### Setting up the connection **Prerequisites:** * Relay provisioned for your tenant, with the Relay Client installed and registered in your network. See the [Relay admin guide](https://docs.uipath.com/automation-cloud/automation-cloud/latest/admin-guide/relay) for enablement. * Your identity has the `MCPServers.View` permission in the folder that will hold the MCP Server. The Automation User and Automation Developer roles include it. * The credential the tool itself requires, an API key or an Integration Service connection, is ready in that folder. **Instructions** 1. On the **MCP Servers** page, select **Add MCP Server**. 2. Select the **Remote** type. 3. Enter a **Name** for the MCP Server. 4. Add a **Description**. 5. Set the connection type to **Private (Relay)**. 6. Configure **Authentication**: - **Connection**: select or add an Integration Service connection to be used for getting the authentication token. ![Screenshot of the Connect to MCP dialog with folder selection, Personal Access Token authentication, and Base URL fields filled in](https://dev-assets.cms.uipath.com/assets/images/orchestrator/Use-Case-1-Connect-to-MCP-6d968ae4.webp) - **Authentication Token**: in the Header section, add a static authentication token. We recommend referencing an asset instead of hardcoding a secret, for example `Authorization: %ASSETS/RemoteBearerToken%`. ![Screenshot of the Add MCP Server dialog for the Remote type, with connection type set to Private (Relay), the Remote URL, and an Authorization header](https://dev-assets.cms.uipath.com/assets/images/orchestrator/Use-Case-1-Remote-URL-9c73c8c9.webp) 7. In **Remote URL**, enter the tool's address as seen inside your network, the same address the Relay Client already reaches. 8. Select **Add**. ### Authenticating the caller Callers authenticate the same way as with any other MCP Server: through the [MCP OAuth flow](https://docs.uipath.com/orchestrator/automation-cloud/latest/user-guide/authenticating-with-the-mcp-oauth-flow) for interactive clients like an IDE, or a personal access token, external application, or interactive login for automated callers. See [MCP Server authentication](https://docs.uipath.com/orchestrator/automation-cloud/latest/user-guide/mcp-server-authentication) for the full method matrix. ``` POST https://cloud.uipath.com/{org}/{tenant}/agenthub_/mcp/{folderKey}/{slug} Authorization: Bearer Content-Type: application/json { "jsonrpc": "2.0", "method": "tools/list", "id": 1 } ``` Your sign-in credentials are never shared with the tool. Its own credential, from the **Headers** or **Connection** field above, is applied separately on every call. ### Verifying the connection A `tools/list` call that returns the tool's tools confirms both the caller's identity and the tool's own credential passed. If the call fails: * **401** usually means the caller's token. * **403** usually means the folder is missing `MCPServers.View`. * **502** or **504** usually means the Relay Client is offline, or the tool rejected its own credential. See [Troubleshooting MCP Server authentication](https://docs.uipath.com/orchestrator/automation-cloud/latest/user-guide/troubleshooting-mcp-server-authentication) and [Troubleshooting MCP Servers](https://docs.uipath.com/orchestrator/automation-cloud/latest/user-guide/troubleshooting-mcp-servers) for more detail. ## Use Case 2: External MCP, direct + OAuth ### The scenario A tool your agents need is already published on the public internet, a SaaS or partner MCP Server, or one you host and expose yourself. You want your agents to call it the same way they call any other MCP Server, with the same governance and audit trail, without needing Relay. If the tool is private or on-premises, use **Use Case 1** instead. ### Setting up the connection **Prerequisites:** * Your identity has the `MCPServers.View` permission in the folder that will hold the MCP Server. The Automation User and Automation Developer roles include it. * The credential the tool itself requires, an API key or an Integration Service connection, is ready in that folder. **Instructions** 1. On the **MCP Servers** page, select **Add MCP Server**. 2. Select the **Remote** type. 3. Enter a **Name** for the MCP Server. 4. Add a **Description**. 5. Set the connection type to **Standard**. 6. Configure **Authentication**: - **Connection**: select or add an Integration Service connection to be used for getting the authentication token. ![Screenshot of the Connect to MCP dialog with folder selection, Personal Access Token authentication, and Base URL fields filled in](https://dev-assets.cms.uipath.com/assets/images/orchestrator/Use-Case-1-Connect-to-MCP-6d968ae4.webp) - **Authentication Token**: in the Header section, add a static authentication token. We recommend referencing an asset instead of hardcoding a secret, for example `Authorization: %ASSETS/RemoteBearerToken%`. ![Screenshot of the Add MCP Server dialog for the Remote type, with connection type set to Standard, the Remote URL, and an Authorization header](https://dev-assets.cms.uipath.com/assets/images/orchestrator/Use-Case-2-RemoteURL-689d76bc.webp) 7. In **Remote URL**, enter the tool's address as seen inside your network. 8. Select **Add**. ### Authenticating the caller Callers authenticate the same way as with any other MCP Server: through the [MCP OAuth flow](https://docs.uipath.com/orchestrator/automation-cloud/latest/user-guide/authenticating-with-the-mcp-oauth-flow) for interactive clients like an IDE, or a personal access token, external application, or interactive login for automated callers. See [MCP Server authentication](https://docs.uipath.com/orchestrator/automation-cloud/latest/user-guide/mcp-server-authentication) for the full method matrix. ``` POST https://cloud.uipath.com/{org}/{tenant}/agenthub_/mcp/{folderKey}/{slug} Authorization: Bearer Content-Type: application/json { "jsonrpc": "2.0", "method": "tools/list", "id": 1 } ``` ### Verifying the connection A `tools/list` call that returns the tool's tools confirms the connection works. If the call fails: * **401** usually means the caller's token. * **403** usually means the folder is missing `MCPServers.View`. * **502** usually means the tool is unreachable, or it rejected its own credential. * A connection error where none is expected usually means the address resolves to a private or internal host; switch to Use Case 1 instead. See [Troubleshooting MCP Server authentication](https://docs.uipath.com/orchestrator/automation-cloud/latest/user-guide/troubleshooting-mcp-server-authentication) and [Troubleshooting MCP Servers](https://docs.uipath.com/orchestrator/automation-cloud/latest/user-guide/troubleshooting-mcp-servers) for more detail.