The local-first, agent-native control plane for ComfyUI — MCP server + Claude Code plugin. 108 tools, 29 AI skills (Flux · WAN · LT2.3 · Qwen · Ideogram4 · Krea2). Author & run workflows, edit your live graph in natural language, manage models & custom nodes. Local, LAN, VPS, or Comfy Cloud.
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.
Install from
M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse
Anthropic's MCP TypeScript SDK has a ReDoS vulnerability
Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default
process.env. You'll be asked to provide them before it can run.AWS_ACCESS_KEY_IDAWS_REGIONAWS_S3_ENDPOINTAWS_SECRET_ACCESS_KEYAWS_SESSION_TOKENAZURE_STORAGE_ACCOUNTAZURE_STORAGE_CONNECTION_STRINGAZURE_STORAGE_KEYCOMFYUI_ALWAYS_RESTART— false Auto-restart a crashed local ComfyUI (bounded by COMFYUI_RESTART_MAX_ATTEMPTS / COMFYUI_RESTART_WINDOW_S)COMFYUI_API_KEY— Cloud is set (targets [Comfy Cloud](https://cloud.comfy.org)) no — HTTP primitives route via cloud.comfy.org over X-API-Key; WebSocket and local-only tools throw CLOUD_UNSUPPORTEDCOMFYUI_ASSET_TTL_HOURSCOMFYUI_CLOUD_URLCOMFYUI_CONVERT_IMAGE_MAX_SOURCE_BYTESCOMFYUI_DOWNLOAD_CACHE_DIR— ~/.comfyui-mcp/cache Content-addressed model-download cache (dedup + concurrent coalescing)COMFYUI_HOST— COMFYUI_URL Full ComfyUI URL, e.g. https://comfy.example.com:8443 — overrides /PORT/SSL and skips auto-detection. Non-loopback hosts opt into remote mode.COMFYUI_JOB_POLL_INTERVAL_SCOMFYUI_JOB_TIMEOUT_SCOMFYUI_LRU_CACHE_SIZE_GB— 0 Cap the download cache in GB; 0 disables LRU evictionCOMFYUI_MCP_AGENT_ALLOWED_MODELSCOMFYUI_MCP_AGENT_MODELCOMFYUI_MCP_AGENT_POCCOMFYUI_MCP_AGENT_PORTCOMFYUI_MCP_AGENT_TOKENCOMFYUI_MCP_AGENT_TUNNELCOMFYUI_MCP_BRIDGE_PORTCOMFYUI_PATH— Remote --comfyui-url / COMFYUI_URL points at a non-loopback host no — server skips auto-detection so stale local installs can't silently absorb uploadsCOMFYUI_PORT— (auto-detect) ComfyUI server port (tries 8188, then 8000)COMFYUI_PYTHONCOMFYUI_RESTART_MAX_ATTEMPTS— COMFYUI_ALWAYS_RESTART false Auto-restart a crashed local ComfyUI (bounded by / COMFYUI_RESTART_WINDOW_S)COMFYUI_RESTART_WINDOW_S— COMFYUI_ALWAYS_RESTART false Auto-restart a crashed local ComfyUI (bounded by COMFYUI_RESTART_MAX_ATTEMPTS / )COMFYUI_SKILL_CACHE_DIRCOMFYUI_SSLCOMFYUI_STARTUP_CHECK_INTERVAL_S— / …_MAX_TRIES 1 / 20 Readiness-probe interval + max tries when starting a local ComfyUICOMFYUI_STARTUP_CHECK_MAX_TRIESCOMFYUI_URL— Remote --comfyui-url / points at a non-loopback host no — server skips COMFYUI_PATH auto-detection so stale local installs can't silently absorb uploadsCOMFYUI_WORKFLOWS_DIRCOMFY_API_KEYCOMFY_HOSTCOMFY_PORTGITHUB_TOKEN— GitHub token for skill generation (avoids rate limits)HUGGINGFACE_TOKEN— HuggingFace token for higher API rate limitsREGISTRY_ACCESS_TOKEN— Comfy Registry API key for publish_custom_node (env-only, never logged)XDG_CONFIG_HOME[](https://m8ven.ai/mcp/artokun-comfyui-mcp-6sczyl)