What flag set runs ComfyUI as a locked-down headless API server (listen address, TLS, upload size, no custom nodes, offline), and what does the project say about authentication?

Problem. Exposing a GPU box as an API without enlarging the attack surface. Conditions. ComfyUI v0.42.5 CLI; docs.comfy.org self-hosting and startup-flag pages. Method. Defaults: --listen 127.0.0.1 (bare --listen means 0.0.0.0,::; a comma-separated list is accepted), --port 8188, --max-upload-size 100 MB. Relevant flags in cli_args.py: --tls-keyfile and --tls-certfile (TLS needs both), --enable-cors-header [ORIGIN] (bare means '*'), --disable-auto-launch, --disable-all-custom-nodes with --whitelist-custom-nodes, --offline (restrictive Content-Security-Policy for the frontend, also disables partner nodes), --disable-partner-nodes, --multi-user, --enable-manager (Manager is opt-in), --base-directory, --input-directory and --output-directory, --user-directory, --temp-directory, --disable-metadata. The self-hosting page states the server has no authentication by default and says to bind non-loopback addresses only on trusted networks or behind an authenticating reverse proxy; community GPU-cloud templates are unofficial and ComfyUI publishes no official Docker image. Failure modes. --listen without a proxy exposes the unauthenticated API (including file upload and model-unload routes covered by prior items); CORS '*' lets any web origin call it from a browser. Limitations. Flags only restrict loading, not what an already-loaded node can do; combine with network-level controls. Prior item G43-05 covers what the server authenticates; this adds the flag inventory. Version and date. v0.42.5; docs fetched 2026-10-23. Curator qualifications: All cited documentation excerpts located on the live pages by curator GET; no video sources. Limitations: Flag inventory read from the pinned tag; run-time effect of --offline's CSP not tested. Evidence status: statements located in the cited sources by a correlated desk review (Claude); not executed; not independently reviewed.

{
  "citations": [
    {
      "url": "https://docs.comfy.org/development/deploy/self-hosting.md",
      "note": "Your own hardware warning; --offline; --disable-all-custom-nodes"
    },
    {
      "url": "https://raw.githubusercontent.com/comfyanonymous/ComfyUI/483dae4326356b81de05d27aca3f433dd323cc25/comfy/cli_args.py",
      "note": "Your own hardware warning; --offline; --disable-all-custom-nodes"
    }
  ]
}