uip (core commands)

Core commands in UiPath CLI that require no tool installation, covering authentication, tool lifecycle, skills, MCP bridge, and shell completion.

The core command surface is everything the host (@uipath/cli) ships with — no tool installation needed. These commands manage authentication, tool lifecycle, AI-coding-agent skills, the MCP bridge, and shell completion. Every command on this page is available the moment npm install -g @uipath/cli finishes.

For commands that talk to a UiPath surface (Orchestrator, Solutions, Agents, etc.), see the per-tool reference pages — each is provided by a separate npm package that the host loads on demand.

The host commands

The CLI host registers 11 top-level commands (uip track is hidden internal telemetry and isn't user-facing — the other 10 are):

Command	Purpose	Login required
uip login	Authenticate via interactive OAuth2, External App, environment variables, or federated/workload-identity; switch tenants. Writes a session to .uipath/.auth.	—
uip logout	Remove the credentials file.	—
uip login status	Show the current org, tenant, expiry, and which credentials file the CLI is reading.	Optional (reports Not logged in otherwise)
uip config	Get, set, and clear local CLI configuration values (including the version-pin uip tools update reads).	—
uip user	Show the identity of the currently authenticated user.	Yes
uip feedback	Send feedback about the CLI.	—
uip tools	List, search, install, update, uninstall the installable tools (Orchestrator, Solution, Agent, Test Manager, …).	—
uip skills	Install UiPath skills into AI coding agents.	—
uip mcp	Expose the CLI as a Model Context Protocol server over stdio.	Per run_command (inherits the file-based session).
uip update	Self-update the CLI, its installed tools, and installed skills.	—
uip completion	Install or print shell tab completion (bash, zsh, fish, pwsh).	—

Synopsis

uip login [--tenant <name>] [--organization <name>] [--authority <url>] [--client-id <id>] [--client-secret <secret> | --client-assertion <jwt>] [--scope <scopes>] [--no-browser] [-f <folder>]
uip login status                       [-f <folder>]
uip login refresh                      [--login-validity <minutes>]
uip login which                        [-f <folder>]
uip login tenant list                  [-f <folder>]
uip login tenant set <name>            [-f <folder>]
uip logout                             [-f <folder>]
uip config get / set / clear <key>
uip user
uip feedback send
uip tools list / search / install / update / uninstall …
uip skills list / search / show / install / update / uninstall --agent <name>
uip mcp serve
uip update [--dry-run] [--tools-only] [--skills-only]
uip completion [shell] [--print] [--uninstall]

Every command also honors the global --interactive/--no-interactive flag (see Global options) — there is no command-specific short form for it.

All core commands honor the global options (--output, --output-filter, --log-level, --log-file, --profile, --interactive/--no-interactive) and follow the standard exit-code contract.

How the core surface relates to tools

Every other uip <tool> … invocation runs on top of these:

1. Authentication is established once with uip login and inherited by every subsequent tool call (Orchestrator, Solution, Agent, …).
2. Tool lifecycle (uip tools install) controls which extension packages are loaded next time you invoke a tool prefix.
3. Skills sit beside tools — they teach AI agents how to use uip rather than adding new commands.
4. MCP wraps the entire surface (core + installed tools) as a single MCP tool that any MCP-aware client can call.
5. Completion discovers commands at install time, so re-run uip completion after uip tools install if you want completion for newly-added commands.

See How UiPath CLI is organized for the host-vs-tool architecture in depth.

Authentication shape

Every core command except the auth commands themselves works without a session — they just talk to local files (config, manifest, completion script). The auth commands manage the session itself:

• uip login — interactive OAuth2 (browser), External App (client credentials), environment-variable token, and federated/workload-identity (--client-assertion). See Authentication. --profile scopes the session to a named credential set, orthogonal to which flow you use.
• uip logout — removes the file. The env-var flow has nothing to clear.
• uip login status — reports the active session.
• uip login refresh — proactively refreshes the access token and emits a machine-readable session payload for programmatic consumers.
• uip login which — prints where the active session/credential file was resolved from.
• uip login tenant list / set — switch tenants without re-authenticating.

Tool commands inherit whatever session is on disk at the time of invocation; --tenant overrides per-call.

Where each command sends its output

Stream	Content
stdout	The structured JSON envelope (Result, Code, Data, …). One per invocation.
stderr	Logs (controlled by --log-level), progress indicators, and human-readable error text. Never machine-parseable JSON.

The split is enforced everywhere; you can redirect them independently:

uip tools list > tools.json 2> uip.log

See Output formats for the five formats (json, table, yaml, plain, markdown) and JMESPath filtering.

See also

• Concepts: how UiPath CLI is organized — what "host" means and why core is split from tools.
• Concepts: tools (plugins) — the auto-install whitelist and version pinning.
• Concepts: skills — how uip skills install extends AI agents.
• Concepts: sessions and credentials — what uip login writes and where.
• Authentication — the auth flows in detail, including federated/workload-identity login.
• Global options, Exit codes — contracts shared by every command.