comfyui-mcp (sandyup/comfyui-mcp) is an MCP server listed on the M8ven Trust Index. It scores 52 out of 100, grade D. It declares 31 tools. No publisher has claimed this listing.

Caution

52/100

comfyui-mcp

Item: comfyui-mcp
Rating: 52
Author: M8ven

MCP server + Claude Code plugin for ComfyUI — execute workflows, generate images, visualize pipelines, manage models, control VRAM, and explore custom nodes, all from your AI coding assistant.

→ sandyup/comfyui-mcp · listed on glama

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every push why connect →

Who stands behind it

sandyup

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

⚡ Connect GitHub for Live Monitored

Install from

Glamanot scored here

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings

🚨

Secret credentials may flow to a network call

2 flows detected: RUNPOD_API_KEY, COMFYUI_MCP_OLLAMA_MAX_TOKENS. We can’t prove the destination matches the brand the credential belongs to.

⚠️

Known vulnerabilities in dependencies: 3 high

Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.

🔐

You'll be asked for 18 credentials: ANTHROPIC_API_KEY, ARENA_API_KEY, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN, AZURE_STORAGE_KEY, COMFYUI_API_KEY, COMFYUI_AUTH_TOKEN, COMFYUI_MCP_AGENT_TOKEN, COMFYUI_MCP_BRIDGE_TOKEN, COMFYUI_MCP_OLLAMA_API_KEY, COMFYUI_MCP_RELAY_KEY, COMFY_API_KEY, GITHUB_TOKEN, HF_TOKEN, HUGGINGFACE_TOKEN, OPENROUTER_API_KEY, REGISTRY_ACCESS_TOKEN, RUNPOD_API_KEY

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// tools this server exposes31 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

list_api_nodes

List hosted partner/API nodes available on the connected ComfyUI (e.g. Flux/BFL, Ideogram, Kling, Stability). These call external image/video providers and run server-side, requiring a Comfy account/API key configured on the ComfyUI server. Returns an empty list if the server has no API nodes (or th…

get_api_node_schema

Return the input schema for a specific API/partner node from the connected ComfyUI's /object_info. Lists visible inputs (with types/defaults/options), hidden inputs (server-filled auth), and outputs. Use list_api_nodes first to find a class_type.

generate_with_api_node

Build a minimal single-node workflow that runs a chosen API/partner node with the provided inputs and enqueue it. Returns immediately with the prompt_id (use get_job_status / get_history for results). Do NOT pass auth credentials in inputs — the ComfyUI server injects those from its logged-in sessio…

view_image

Fetch a registered asset's bytes and return them as an inline image so the agent can see the result. Use this after enqueue_workflow completes (asset_id is included in the completion notification) to inspect, critique, or compare generated images. Only supports image mime types (PNG/JPEG/WebP); audi…

list_assets

List recently generated assets from the in-memory registry, newest-first. Assets are registered automatically when a workflow completes successfully. The registry is ephemeral and clears on server restart; records expire after COMFYUI_ASSET_TTL_HOURS (default 24h).

get_asset_metadata

Get full provenance for a registered asset including the workflow snapshot that produced it. Use this to inspect the parameters that generated an image before calling regenerate with overrides.

regenerate

Re-enqueue the workflow that produced an existing asset, optionally applying parameter overrides. Overrides are applied to any node input matching the key name (e.g. cfg, steps, sampler_name, scheduler, seed, denoise, text). Seeds are re-randomized by default so each regenerate yields a fresh image …

analyze_color

Measure the color of a rendered image (not by eye): returns black/white points, contrast (luma std), saturation, per-channel means + cast, and clipping — plus heuristic flags (washedOut, lowContrast, liftedBlacks, dimHighlights, lowSaturation, colorCast) and a one-line verdict. Source = asset_id, a …

list_tools

List every comfyui-mcp capability as a token-light catalog: tool names with one-line summaries, grouped by category. Start here. Then use describe_tool to get a tool's parameters and call_tool to run it.

describe_tool

Get the full description and JSON Schema of one tool from the catalog. Always call this before the first call_tool of a tool you haven't used in this session.

call_tool

Execute a tool from the catalog by name. Pass its parameters in `args` (object). The result is exactly what the underlying tool returns.

get_defaults

set_defaults

get_logs

Get ComfyUI server runtime logs. Useful for debugging execution errors, model loading issues, missing nodes, and Python tracebacks.

get_history

Get execution history for a ComfyUI prompt. Returns status, timing, cached nodes, output details, and full error information including Python tracebacks. Use after a failed enqueue_workflow to diagnose what went wrong.

list_extra_paths

add_extra_path

remove_extra_path

generate_audio

generate_with_controlnet

Generate an image conditioned by a ControlNet preprocessed image (pose skeleton, depth, canny, normal, etc.) plus a text prompt. Upload the control image first with upload_image, then pass its filename as control_image. Unspecified params fall back to your defaults; checkpoint and controlnet_model a…

generate_with_ip_adapter

Generate an image guided by a reference image's style/subject via IP-Adapter, plus a text prompt. Requires the ComfyUI_IPAdapter_plus custom nodes. Upload the reference first with upload_image, then pass its filename as reference_image. Unspecified params fall back to your defaults; checkpoint auto-…

generate_image

generate_video

suggest_settings

Recommend concrete, proven sampler/scheduler/steps/CFG (and denoise/shift/LoRA) settings derived from THIS MCP server's local generation-history database (populated as you run workflows; not from ComfyUI). Read-only and works without a running ComfyUI. Narrow results by model_family, lora_hash, or a…

generation_stats

Show statistics from this MCP server's local generation-history database (populated as you run workflows; not from ComfyUI itself): total generations, count of unique sampler/scheduler/steps/CFG combos, a per-model-family breakdown, and the most-reused settings. Read-only; works without a running Co…

health_check

Pre-flight diagnostic for the connected ComfyUI: one call that aggregates the signals an agent should check before dispatching a batch. Reports ComfyUI version/Python/PyTorch, GPU name + VRAM free/total, system RAM free, queue depth (running + pending), per-category /models populations (catches empt…

convert_image

Re-encode a generated image to PNG, JPEG, or WebP and return it inline as an image content block. Source can be a registered asset_id or a path under the local ComfyUI output directory. Optionally writes the converted image back under the output directory and reports source/output size plus bytes sa…

get_image

stage_output_as_input

workflow_from_image

list_output_images

List recently generated image AND video files from ComfyUI's output/ directory, newest-first, with each file's kind ('image' | 'video'), subfolder, size, and modification time. Covers stills (.png/.jpg/.jpeg/.bmp) and video/animation outputs (.mp4/.webm/.mov/.mkv/.m4v/.avi/.gif/.webp). LOCAL ComfyUI…

// known CVEs in dependencies3 high

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.12.1GHSA-345p-7cg4-v4c7

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

high@modelcontextprotocol/sdk@1.12.1GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

high@modelcontextprotocol/sdk@1.12.1GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

Depend on this server? Get alerted when its CVEs change.Watch this server free →

// environment variables

To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.

🔐 secretANTHROPIC_API_KEY

configARENA_API

🔐 secretARENA_API_KEY

configARENA_BASE_URL

configARENA_MAX_ROUNDS

configARENA_MODELS

configARENA_OUT

configARENA_SCENARIO_TIMEOUT_MS

configARENA_TIER

configAWS_ACCESS_KEY_ID

configAWS_REGION

configAWS_S3_ENDPOINT

🔐 secretAWS_SECRET_ACCESS_KEY

🔐 secretAWS_SESSION_TOKEN

configAZURE_STORAGE_ACCOUNT

🔐 secretAZURE_STORAGE_KEY

configBRIDGE_URL

configCAP_MS

configCOMFYUI_ALWAYS_RESTARTfalse Auto-restart a crashed local ComfyUI (bounded by COMFYUI_RESTART_MAX_ATTEMPTS / COMFYUI_RESTART_WINDOW_S)

🔐 secretCOMFYUI_API_KEYCloud is set (targets [Comfy Cloud](https://cloud.comfy.org)) no — HTTP primitives route via cloud.comfy.org over X-API-Key; WebSocket and local-only tools throw CLOUD_UNSUPPORTED

configCOMFYUI_ASSET_TTL_HOURS

configCOMFYUI_AUTH_HEADERAuthorization Header name for COMFYUI_AUTH_TOKEN (e.g. X-API-Key).

configCOMFYUI_AUTH_SCHEMEBearer for Authorization, else none Scheme prefix on the token value (e.g. Bearer, Token).

🔐 secretCOMFYUI_AUTH_TOKENGeneric auth token for a self-hosted ComfyUI behind a reverse proxy / API gateway (distinct from Comfy Cloud). When set, attached to every ComfyUI request. Never logged.

configCOMFYUI_CLOUD_URL

configCOMFYUI_DOWNLOAD_CACHE_DIR~/.comfyui-mcp/cache Content-addressed model-download cache (dedup + concurrent coalescing)

configCOMFYUI_HOST127.0.0.1 ComfyUI server address

configCOMFYUI_JOB_POLL_INTERVAL_S

configCOMFYUI_JOB_TIMEOUT_S

configCOMFYUI_LRU_CACHE_SIZE_GB0 Cap the download cache in GB; 0 disables LRU eviction

configCOMFYUI_MCP_AGENT_ALLOWED_MODELS

configCOMFYUI_MCP_AGENT_MODEL

configCOMFYUI_MCP_AGENT_POC

configCOMFYUI_MCP_AGENT_PORT

🔐 secretCOMFYUI_MCP_AGENT_TOKEN

configCOMFYUI_MCP_AGENT_TUNNEL

configCOMFYUI_MCP_BRIDGE_HOST

configCOMFYUI_MCP_BRIDGE_PORT

🔐 secretCOMFYUI_MCP_BRIDGE_TOKEN

configCOMFYUI_MCP_CLAUDE_JSON

configCOMFYUI_MCP_CODEX_MODEL

configCOMFYUI_MCP_CODEX_SANDBOX

configCOMFYUI_MCP_DATA_DIR

configCOMFYUI_MCP_FORCE_REMOTE1) alongside --comfyui-url/COMFYUI_URL to force

configCOMFYUI_MCP_GEMINI_MODEL

configCOMFYUI_MCP_INSECURE_BRIDGE

configCOMFYUI_MCP_INTERRUPT_RELEASE_MS

configCOMFYUI_MCP_INTERRUPT_S30 Seconds cancel_job waits for an interrupt to actually stop a job before escalating to /free and reporting it wedged

configCOMFYUI_MCP_OLLAMA_API

🔐 secretCOMFYUI_MCP_OLLAMA_API_KEY

configCOMFYUI_MCP_OLLAMA_BASE_URL

configCOMFYUI_MCP_OLLAMA_MAX_TOKENS

configCOMFYUI_MCP_OLLAMA_MODEL

configCOMFYUI_MCP_OPENROUTER_MODEL

configCOMFYUI_MCP_PANEL_EFFORT

configCOMFYUI_MCP_PANEL_MCP_PORT

configCOMFYUI_MCP_PANEL_MODEL

configCOMFYUI_MCP_PANEL_SECRETS

configCOMFYUI_MCP_PANEL_SETTINGS

configCOMFYUI_MCP_PARENT_PID

configCOMFYUI_MCP_PARENT_STARTED_AT_MS

configCOMFYUI_MCP_PROGRESS_DIR

🔐 secretCOMFYUI_MCP_RELAY_KEY

configCOMFYUI_MCP_RELAY_URL

configCOMFYUI_MCP_STALL_S180 Render-wedge watchdog: seconds a sampler step can re-emit the same progress before a STALL/BACKLOG note is prepended to the agent's next turn (clamped 15–3600s; live-tunable from the panel)

configCOMFYUI_MCP_TEST_ATTEMPTS

configCOMFYUI_MCP_TOOL_TRACE

configCOMFYUI_MCP_TRANSCRIPT_DIR

configCOMFYUI_MCP_TUNNEL_BACKEND

configCOMFYUI_MCP_TURN_IDLE_MS

configCOMFYUI_PATHRemote --comfyui-url / COMFYUI_URL points at a non-loopback host, or --force-remote is set no — server skips auto-detection so stale local installs can't silently absorb uploads

configCOMFYUI_PORT(auto-detect) ComfyUI server port (tries 8188, then 8000)

configCOMFYUI_PYTHON

configCOMFYUI_SKILL_CACHE_DIR

configCOMFYUI_SSL

configCOMFYUI_URLThis is sugar for --panel-orchestrator with set from the URL: the

configCOMFYUI_WORKFLOWS_DIR

🔐 secretCOMFY_API_KEY

configCOMFY_HOST

configCOMFY_PORT

configDURATION_MS

configGEMINI_CLI_HOME

🔐 secretGITHUB_TOKENGitHub token for skill generation (avoids rate limits)

🔐 secretHF_TOKEN

🔐 secretHUGGINGFACE_TOKENHuggingFace token for higher API rate limits

configLOG_ORCH

configOLLAMA_HOST

configOLLAMA_MODEL

🔐 secretOPENROUTER_API_KEY

configPANEL_AGENT_BACKEND

🔐 secretREGISTRY_ACCESS_TOKENComfy Registry API key for publish_custom_node (env-only, never logged)

🔐 secretRUNPOD_API_KEY

configRUNPOD_DONOR

configRUNPOD_TEMPLATE_ID

configSCENARIO_CAP_MS

configSCENARIO_FILTER

configSEED_NODES

configSKIP_TEMPLATE

configSMOKE_BASE_URL

configSMOKE_BRIDGE_PORT

configSMOKE_MODELS

configSMOKE_TURN_TIMEOUT_MS

configTASK

configTEST_PORT

configXDG_CONFIG_HOME

Deployment configuration, supplied by whoever hosts the server. Users are not asked for these.

deployAZURE_STORAGE_CONNECTION_STRING

// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

31/31 tools missing one or more hints — list_api_nodes (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_api_node_schema (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); generate_with_api_node (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +28 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Tool inputs are validated

Only 10/31 tool handlers declare input schemas (32%)

Declare an inputSchema with zod/joi/yup on every tool definition.

Tool handlers catch errors

29/31 tool handlers wrap calls in try/catch (94%)

Wrap each tool handler body in try/catch and return a structured error response.

Tool test coverage

Only 4/31 tools referenced in tests (13%)

Write tests that reference each tool by name so every tool has at least one test.

Shell command execution

24 child_process calls — runs shell commands

Prefer library functions over shell-outs. If you must shell out, ensure all inputs are properly escaped.

No arbitrary install scripts

Has postinstall/preinstall script — runs arbitrary code on npm install

Remove postinstall/preinstall hooks unless they’re essential.

Production dependencies are patched

0 critical, 3 high severity in production deps — @modelcontextprotocol/sdk@1.12.1 (high), @modelcontextprotocol/sdk@1.12.1 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail

The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.

// improvement guidance — verified publishers only

We have 8 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Verified](https://m8ven.ai/badge/mcp/sandyup/comfyui-mcp?variant=verified)](https://m8ven.ai/mcp/sandyup/comfyui-mcp)

Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.

commit: fee6e53a38b0d3b90f3b97ae061d7fa40ab19459

code hash: 1fe3ef4df598429024229cdb313f1b0f4bd08d16371e7639ba8907a11bd91b00

view raw JSON →

Check MCPs from inside your assistant

Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check

check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern

How to add it →Free · no account needed · works in any MCP client