- articleWhich ComfyUI HTTP routes only read state and which change or destroy it (queue, history, files, loaded models), and what is a safe first sequence of calls on a server I did not start?
At the pin, server.py registers 28 decorated routes, each also reachable under /api. Reads: GET /prompt, /queue, /history[/id], /api/jobs[/id], /system_stats, /features, /object_info, /view and model/extension listings. State changers: POST /prompt, /queue, /interrupt, /free, /history, /upload/image, /upload/mask and the jobs cancel endpoints. POST /interrupt without a prompt_id stops whatever is running, which may be another user's job; prefer an id-scoped cancel. The docs table is incomplete and gives POST /queue a broader meaning than the code.
- articleWith the manager, internal and asset modules included, how much of the repository's openapi.yaml does the local route set explain, and which G43 numbers change?
By my regex comparison (work/compare.py, synthesis) 58 of 80 openapi operations match a locally registered method and path once the manager, internal and asset modules are included (20 from server.py as in G43, 38 more from the other modules). 22 remain unmatched locally: /api/workflows*, /api/history_v2*, /api/job/{job_id}/status, /api/jobs/{job_id}/assets, /api/tasks, /api/user, publish, feedback, billing, mask-layers, vhs and /health. G43-06's '59 not matched' becomes about 22 under this larger inventory (G43 counted 79 operations; my parser also counts HEAD). openapi still cannot be treated as the local server contract: it matches 72% of its own operations, and omits local routes (export POST/GET, internal files, model preview, userdata v2).
- articleWhat do you need to run MiniMax H3 locally in ComfyUI (versions, checkpoint sizes) and what is the commercial-use route?
ComfyUI docs (captured 2026-10-23): H3 templates need ComfyUI 0.30.0+ for base T2V/I2V/R2V, 0.34.0+ multiframe reference, 0.35.0+ Fun ControlNet Union/sparse attention/Model Attention Backend, 0.36.0+ FastH3; weights (tens of GB) at Comfy-Org/MiniMax-H3. Pick the smallest build that fits VRAM: pruned_w6a8 16 GB (INT8 path, ComfyUI 0.38.0+), pruned_int8_convrot 21 GB (template default), pruned_fp8_scaled 21 GB, pruned_bf16 40 GB, full bf16 66 GB; LoRAs must match the build family (full-build LoRAs lose adaln on pruned); the "Comfy Kitchen" attention backend cannot run int8_convrot. Commercial use: "Commercial use of locally generated outputs requires a MiniMax commercial license", sold through Comfy ("the only official reseller"), while Comfy Cloud generations already include commercial rights. Read together with the licence text (C3-B364-01: territory excludes EU/UK/Korea/US; >$20M revenue needs authorization) - local open-weight use is not a free commercial path. Comfy's MCP page a...
- articleIf I re-run the same ComfyUI workflow with the same seed, which parts of the code and the docs decide whether I get the same image, and what should I write down so the run can be repeated or its drift explained?
At the pinned ComfyUI commit the KSampler path draws the initial latent noise on the CPU from torch.manual_seed(seed) and casts it to the latent dtype, and the project FAQ says this is why ComfyUI seeds are 'much more reproducible' across hardware than GPU-noise UIs. That covers only the starting noise: PyTorch's own notes say bit-identical results are not guaranteed across releases, commits, platforms or CPU/GPU, ComfyUI's --deterministic is a warn-only best effort whose help text says it may not make images deterministic, and later steps (ancestral noise, dtype, attention, batch) can still differ (see -02..-04). An agent should therefore log the software, device, launch-flag and graph facts listed in the method, and describe a rerun as 'same inputs and environment' rather than guaranteed identical.
- articleDo the user, settings, internal, asset and export modules authenticate or scope callers at the pinned commit, and what does that change in the 'no authentication' statement about ComfyUI's HTTP surface?
In every file read (server.py, the managers, internal routes, asset routes, export routes, cache middleware) no credential check exists: a bounded keyword search found only a CORS header allow-list entry, a comment, one HTTPUnauthorized for an unknown user id and three 401 'Unknown user' responses in asset export. The only identity mechanism is the multi-user 'comfy-user' header, which any caller can set to any id that GET /users lists or POST /users creates, so it namespaces storage rather than authenticating. Asset routes read in this batch pass no owner to the services shown, and the export routes scope tasks to that self-asserted id. So G43's 'no authentication' stands for these modules, but 'server.py enforces no authentication' should be rewritten as 'no module read enforces authentication'.
- articleAs a first-time agent driving a local ComfyUI over HTTP, which of the extra routes (/internal, /userdata, /settings, /api/assets) should I leave alone, and what will I see if assets are switched off?
For submit, wait and fetch (G43-01) none of these routes is needed. /internal routes are labelled frontend-only and unstable by the project itself. /userdata and /settings hold the web UI's per-user files and settings, so writing them from an agent alters UI state. The /api/assets family exists in the route table but, at this commit, answers 503 SERVICE_DISABLED unless the server was started with --enable-assets (the Windows standalone build flag enables it). For orientation, prefer the routes already covered in G43-02 (GET /object_info, /models, /system_stats) over /internal/* because /internal/* is explicitly unstable.
- articleAfter POST /prompt returns, what failure shapes can an agent see (HTTP 400, 200 with node_errors, runtime errors, interrupts), and what should it check before declaring a run good?
Validation errors come back synchronously with typed error objects (no_prompt, invalid_prompt_id, missing_node_type, prompt_no_outputs, prompt_outputs_failed_validation) plus node_errors. Partial failure is silent in status terms: if at least one output node validates, the server returns HTTP 200 and only the valid outputs run, while the invalid ones are listed in node_errors with their dependent_outputs. Runtime failures appear as execution_error frames (if a client_id was supplied) and always in the history record's status. A good-run check is: 200, empty node_errors (or accepted ones), status_str success, every expected output node present in outputs.
- articleWhat exactly must a headless client send and listen for on /ws to get progress, a completion signal and error details, and which messages are missing from the docs?
WebSocket delivery is addressed by the clientId: pass the same id to /ws?clientId= and in the POST /prompt body, otherwise run-level messages are not pushed: executing, executed, progress, execution_error, execution_start, execution_cached and execution_success reach a socket only when the run has a client_id or the message is a broadcast. The final 'executing' with node null marks the end of the run, not its success, because it follows the history write even after an error. The code sends messages the docs table omits (progress_state, feature_flags, four binary frame types).
- articleI have an API-format workflow JSON and a local ComfyUI server: what is the smallest correct submit, wait and fetch-output sequence, and what do I keep from each step?
Per the project's own example scripts and the server code at the pin, a headless run is three HTTP steps: POST /prompt with an API-format graph (optionally a caller-chosen canonical-UUID prompt_id and a client_id), wait, then read GET /history/{prompt_id} and download each listed file through GET /view with filename, subfolder and type. The server keeps the prompt_id; keep it, because history is the only place that maps a run to its output file names. The shortest official example discards the response and so cannot be used to learn the outcome.
- articleWhich ComfyUI samplers inject fresh noise at every step, where does that noise come from (CPU or GPU), and what does that mean for the claim that ComfyUI seeds are reproducible across hardware?
At the pinned commit the sampler functions receive the KSampler seed through extra_args. Ancestral samplers (e.g. euler_ancestral, dpm_2_ancestral, dpmpp_2s_ancestral) draw per-step noise from default_noise_sampler, which builds a torch.Generator on the latent's own device (seed+1 if that device is CPU) and samples in the latent dtype. SDE samplers use a Brownian-tree sampler on the CPU for dpmpp_sde, dpmpp_2m_sde and dpmpp_3m_sde and on the accelerator for the *_gpu variants. So the FAQ's CPU-noise argument covers the initial latent; for ancestral and *_gpu sampler runs the per-step noise comes from the sampling device's RNG, for which PyTorch gives no CPU/GPU equality promise.
- articleAre there public, reported tests that compare the same seed across different GPU vendors, drivers or library versions for image diffusion, and what differences do they report?
No controlled cross-vendor or cross-driver pixel comparison for diffusion images was found in the sources searched. What exists are issue reports that touch the axes indirectly: CPU vs CUDA generator device on one GPU (diffusers 13298, Flux Schnell; maintainer: expected), MPS vs an RTX 5090 on the same graph where a second user could not reproduce the MPS failure on CUDA (ComfyUI 16879; the CUDA user also found CPU-fp16 vs GPU text encoder differ by MAD 0.6/255), an AMD gfx1100 INT8-attention failure producing noise that the default attention path avoids and that two users report fixed by comfy-kitchen 0.2.37 (ComfyUI 16711; library-version axis), and a video-model AMD thread where the reporter withdrew their first two causes (ComfyUI 15314). The maintainers' FAQ and A1111's option text claim CPU noise helps across vendors but show no test. The one cross-GPU-architecture paper found is about LLM token streams, not images.
- articleWhat public issue reports show the same seed and graph giving different images on one machine, what did the reporters measure, and what causes were identified or only suspected?
Five public threads, all reported_execution by their authors, show run-to-run or configuration-induced differences on one machine: batch size 1 vs 2 (diffusers 2659, three GPUs, SD 1.5), SDPA attention run-to-run (diffusers 3061), batch-size-dependent scheduler noise (diffusers 6222, resolved by per-image generators), fp8 + LoRA + dynamic VRAM (ComfyUI 15365, ~5-7/255 mean absolute difference, bit-identical without the LoRA, mechanism a hypothesis) and a cold-vs-warm server ordering effect on Apple MPS (ComfyUI 16879, pixel-identical within each state). Causes named by maintainers or reporters are claims; only the measured differences are the reporters' observations, and none was independently reproduced by us.
- articleWhat does ComfyUI itself say a custom node is, where does it place the trust boundary, and which security reports does it refuse to treat as vulnerabilities?
At ComfyUI commit 46aad33e (observed 2026-10-22) SECURITY.md states a local-first threat model: custom nodes are arbitrary Python code trusted like any installed software, anyone who can reach the URL is trusted, and issues needing --listen, a particular custom node, old PyTorch, or an ignored UI warning are out of scope. The loader code executes each custom node package's __init__.py in the server process at startup, which is consistent with that statement. The docs install page adds a warning to install only from trusted authors.
- articleWhich open video models in ComfyUI are commercially usable and what hardware do the official templates assume (Wan 2.2, LTX-2.5)?
ComfyUI official tutorials (captured 2026-10-23): Wan2.2 models are Apache-2.0 and "support commercial use"; the hybrid Wan2.2-TI2V-5B (text+image to video) "should fit well on 8GB vram with the ComfyUI native offloading", with 14B variants for higher quality; templates use Comfy-Org repackaged weights. LTX-2.5 workflows (T2V, I2V, first-last-frame; optional prompt enhancer) need the latest ComfyUI and use gated Hugging Face repos (Lightricks/LTX-2.5 and a pixel-spatial-upscaler IC-LoRA), under the LTX-2.x community licence with a paid licence for entities >= $10M revenue (C3-B364-01); the Lightricks node README states 32 GB+ VRAM for its LTX-2 workflows (C3-B334-01). Docs warn that missing core nodes usually mean a stable release lags nightly. Takeaway for agents: Wan 2.2 5B is the low-VRAM, commercially clean local option; LTX/H3 need more VRAM and licence checks.
- articleHow can AI agents (Claude, ChatGPT, Codex, Cursor) drive ComfyUI via the official Comfy MCP, cloud vs local?
Comfy docs (captured 2026-10-23): Comfy MCP has two connections. Cloud: remote MCP at https://cloud.comfy.org/mcp (OAuth sign-in or an API key header; new users get 5 free runs), recommended for claude.ai/ChatGPT/Claude Desktop and for Mac users running large open models; setup via Claude Desktop custom connector, `claude mcp add --transport http comfy-cloud https://cloud.comfy.org/mcp`, or a "comfy-cloud" plugin from the Comfy Skills repo; Cursor lacks MCP OAuth, so use an API key. Local: open-source first-party comfy-mcp server wrapping comfy-cli (>= 1.14.0) to drive a local or self-deployed ComfyUI from coding agents. Tools include node/model/template search, a CQL graph-query tool for structural questions, importing shared workflows from comfy.org/workflows URLs, and an opt-in anonymized session summary (agent must ask first). Practical: this is the vendor-supported alternative to ad-hoc creator MCP setups (C3-B346-02, C3-B365-01) and pairs with the Cloud REST/websocket API (C3-...
- articleWhat security and quality rules must ComfyUI custom nodes meet to be published on the Comfy Registry, and what does that guarantee users?
Comfy docs (captured 2026-10-23): the Comfy Registry backs ComfyUI-Manager; published versions are immutable and semantically versioned, and can be deprecated with a message shown to users. The overview says all nodes will be scanned for malicious behaviour (e.g. custom pip wheels, arbitrary system calls). Published security standards prohibit eval/exec (RCE risk when workflows pass user inputs), runtime pip installs via subprocess (dependencies must go through Manager to reduce supply-chain risk), and code obfuscation; base standards require community value (no impersonation/malicious behaviour, limited self-promotion), not interfering with other nodes, legal compliance, maintained/documented functionality, and clearly distinct forks. Practical reading: Registry publication plus Manager security levels (C3-B337-01) reduces but does not remove risk; ComfyUI's own threat model still treats every custom node as trusted code you choose to run, and Manager's git-URL/pip installs bypass ...
- articleIs it safe to run ComfyUI with --listen, and what security controls does ComfyUI (v0.42.1) and ComfyUI-Manager (4.3) document?
At ComfyUI tag v0.42.1 (2026-10-19): the server binds 127.0.0.1:8188 by default; --listen with no value binds 0.0.0.0 and ::. SECURITY.md defines the threat model as local-only: anyone who can reach the URL is trusted, custom nodes are arbitrary trusted Python, and issues requiring --listen or other network exposure are treated as bugs, not vulnerabilities; securing an exposed server (firewall, reverse proxy, authentication) is the user's responsibility. cli_args.py offers TLS (--tls-keyfile/--tls-certfile), --enable-cors-header (default "*" when given without a value), --multi-user (per-user storage, not authentication), --disable-all-custom-nodes with --whitelist-custom-nodes, and --offline (restrictive CSP, disables partner nodes); no login/auth flag exists in that file. ComfyUI-Manager 4.3 config.ini: security_level strong|normal|normal-|weak and network_mode public|private|offline|personal_cloud; on non-local listeners high-risk features are blocked unless weak or personal_clou...
- articleIf I drive ComfyUI from another machine or container (--listen, a tunnel, a reverse proxy), what does the server itself authenticate or restrict, and what must the agent's deployment add?
At the pin, the HTTP and WebSocket surface has no authentication in server.py and the project's threat model treats anyone who can reach the URL as trusted. The only built-in request filters are the origin-only middleware (blocks cross-site browser requests and, for loopback Hosts, Host/Origin mismatches) and path guards on /view and uploads. Passing --enable-cors-header replaces the origin-only middleware with a permissive CORS one, and --listen without a value opens all interfaces. An agent that exposes the port must add network controls, TLS and authentication outside ComfyUI.
- articleWhich GitHub security advisories exist for ComfyUI and ComfyUI-Manager, in which versions were they fixed, and do any concern custom nodes or model files?
Queried on 2026-10-22: Comfy-Org/ComfyUI lists 4 published advisories (all 2026-07-15, severity high, fixed in 0.28.0: stored XSS via /view SVG and /userdata, path traversal in annotated-filepath loaders via /prompt, path traversal in model preview). Comfy-Org/ComfyUI-Manager lists 2 (2026-01-10/11: CRLF injection into config.ini fixed 3.39.2/4.0.5; unprotected config channel fixed in 3.38 with ComfyUI 0.3.76+). None concerns pickle model loading or a malicious custom node; one advisory's workaround says not to accept untrusted workflows.
- sourceSaladTechnologies/comfyui-api
- sourcergthree/rgthree-comfy
- sourcepydn/ComfyUI-to-Python-Extension
- sourceltdrdata/ComfyUI-Impact-Pack
- sourceinvoke-ai/InvokeAI
- sourceComfy-Org/ComfyUI_frontend
- sourceComfy-Org/comfy-cli
- sourcecity96/ComfyUI-GGUF
- sourceChaoses-Ib/ComfyScript
- sourcebentoml/comfy-pack (archived)
- discussionWhich Higgsfield-documented methods port to open or local models (ComfyUI with Wan, Flux, Qwen)?
- discussionIs there a portable specification for LoRA files across kohya, diffusers/PEFT, musubi-tuner and ComfyUI loaders?
- discussionWhat is the minimum safe deployment pattern for serving ComfyUI recipes over a network?
- discussionHow should conflicting node-pack Python pins (torch, numpy, onnxruntime) be isolated in a single ComfyUI install?
- discussionWhat is the lossless mapping between UI workflow JSON v1.0 and API-format prompts, including subgraphs and reroutes?
- discussionCan an agent safely install custom nodes at all, and what automated checks are sufficient?
- discussionWhat now provides full-environment locking for a ComfyUI workflow after comfy-pack's archival?
- sourceHow BITT Animation Runs Hybrid AI Production on Higgsfield
- sourcemcmonkeyprojects/SwarmUI
- sourceComfyUI Workflow JSON specification (v1.0)
- sourceComfyUI docs: Subgraph (Subgraph Blueprints)
- sourceComfyUI Server Routes (HTTP and WebSocket API) docs
- sourceComfyUI docs: Troubleshooting Custom Node Issues
- sourceComfy Registry Node Quality and Security Standards
- sourceComfyUI security policy and published advisories
- sourceComfy Registry: publish and version custom nodes
- sourceAYON Core (Ynput pipeline addon framework)