B — Some risk signals Graded October 16, 2026Minor concerns worth a quick check.Based on public adoption and transparency signals as of October 16, 2026. Our opinion, not a code audit or security guarantee.
AI agent skill · Developer tools, Communication
comfyui-mcp
Local-first, agent-native control plane for ComfyUI — MCP server + sidebar agent that generates images, video & audio, authors and runs workflows, and edits your live graph in natural language on ANY LLM (Claude, ChatGPT, Gemini, offline Ollama, or any hosted model). 178 tools, 36 AI skills, 55 installer packs. Local, LAN, VPS, or Comfy Cloud.
Bottom line: Signal-based grade (5/7 points): well starred on GitHub, listed in several sources, public source code. This reflects adoption and transparency, not a code audit.
- Popularity score
- 67/100
- Rank
- Not ranked: outside the 500 most popular tools
- GitHub stars
- 828
- Weekly downloads
- 21.6k
What it does
comfyui-mcp gives any LLM (Claude, ChatGPT, Gemini, Ollama, etc.) native control over ComfyUI for generating images, video, and audio through natural language commands. It runs as an MCP server with 178 tools and 36 AI skills, letting agents author, execute, and edit workflows locally or remotely while keeping processing on your infrastructure.
Who it’s for
AI builders and enterprises running ComfyUI who want agentic control without vendor lock-in, and executives evaluating local-first generative AI workflows. Best suited for teams comfortable self-hosting or using VPS/LAN deployments.
Copy-paste setup
Check these steps against the project’s own instructions before running anything.
Via npm (recommended):
npm install comfyui-mcp
For Claude Desktop, add to claude_desktop_config.json:
{
"mcpServers": {
"comfyui": {
"command": "npx",
"args": ["comfyui-mcp"]
}
}
}
Verify against the repo README (https://github.com/artokun/comfyui-mcp (opens external site)) for ComfyUI server URL and authentication configuration.
Risks
- Credential exposure: Natural language commands may leak model/API keys if ComfyUI credentials are passed in prompts or logged by the LLM.
- Prompt injection: Agents executing arbitrary workflow JSON from user input could load malicious nodes or execute unvetted Python if ComfyUI custom nodes are enabled.
- Local resource exhaustion: No built-in rate limits or resource quotas; a malicious prompt could trigger GPU/memory-intensive generations, causing denial of service.
- Supply chain via npm: Dependency chain risk; verify pinned versions and audit transitive dependencies for security updates.
- Data exfiltration: Generated images/workflows are accessible via the MCP server; ensure ComfyUI runs on trusted networks and restrict LLM access to sensitive model weights or datasets.
How to stay secure
Least-privilege permissions
- Run ComfyUI and MCP server under a dedicated non-root user account with read-only access to model weights; restrict write permissions to output directories only.
- Store API keys and credentials in environment variables or
.envfiles with 0600 permissions; never embed in prompts or workflow JSON. - Disable or sandbox custom node execution; whitelist only vetted nodes and pin versions in
custom_nodes/requirements files. - Enforce LLM role-based access control: provide the agent only the subset of MCP tools needed for the intended use case (e.g., deny workflow authoring if read-only inference is sufficient).
Network isolation
- Run ComfyUI + MCP server on localhost or trusted LAN only; use firewall rules to deny external ingress on the MCP port.
- If exposing via VPS or Comfy Cloud, require mTLS or API key authentication; rotate credentials regularly.
- Proxy LLM requests through a gateway that scrubs credentials from prompt logs and enforces rate limits before forwarding to the agent.
- Disable remote code execution (RCE) via Python evaluation in ComfyUI's advanced settings; validate and sanitize all workflow JSON before execution.
Monitoring
- Log all MCP agent commands, LLM prompts, and workflow JSON to an immutable audit trail; alert on credential patterns (API keys, bearer tokens, model paths).
- Monitor GPU/CPU/memory utilization and set hard quotas; kill long-running generations exceeding thresholds to prevent resource exhaustion DOS.
- Track file I/O from ComfyUI output directories; flag unexpected exfiltration of model weights or sensitive datasets.
- Review dependency updates monthly; use
npm auditand SBOM tooling to detect transitive vulnerabilities in MCP server and custom nodes.
Red flags to watch for
- Prompts containing plain-text credentials, file paths to private model weights, or instructions to bypass validation logic.
- Requests to load workflows from untrusted URLs or install unsigned custom nodes; any deviation from pinned node versions.
- Sudden spikes in GPU memory allocation, generation count, or output file sizes; sustained high CPU suggesting injected compute loops.
- MCP server logs showing failed authentication attempts, HTTP 403 errors, or requests to non-whitelisted tools; mismatches between logged prompts and agent behavior.
Alternatives
- ComfyUI native API + custom scripts — Direct HTTP control without MCP overhead, but requires custom agent code per LLM.
- Stability AI API / Replicate — Managed, vendor-hosted image generation; simpler but centralized and less flexible for custom workflows.
- Invoke AI — Alternative local node-based UI with some agentic features, but smaller ecosystem and less active development.
- Banana or Lambda Labs compute APIs — Remote ComfyUI execution as a service; trades local control for managed infrastructure.