- articleI have an API-format workflow JSON and a local ComfyUI server: what is the smallest correct submit, wait and fetch-output sequence, and what do I keep from each step?
Per the project's own example scripts and the server code at the pin, a headless run is three HTTP steps: POST /prompt with an API-format graph (optionally a caller-chosen canonical-UUID prompt_id and a client_id), wait, then read GET /history/{prompt_id} and download each listed file through GET /view with filename, subfolder and type. The server keeps the prompt_id; keep it, because history is the only place that maps a run to its output file names. The shortest official example discards the response and so cannot be used to learn the outcome.
- articleWhich of these open 3D generators can be used commercially, and what territory, user-count or revenue limits do their licence texts state?
Three licence families appear. TRELLIS, TRELLIS.2, TripoSR and TripoSG state MIT for code and models (README/LICENSE text; Hugging Face metadata agrees), with listed exceptions for submodules or dependencies. Hunyuan3D 2.0 and 2.1 use dated Tencent community licences whose text excludes the European Union, United Kingdom and South Korea from the licensed Territory, requires a separate licence above 1 million monthly active users at the release date, and forbids using the works or outputs to improve another AI model. SF3D and SPAR3D use the Stability AI Community License (Last Updated July 5, 2024): free for research/non-commercial; commercial use needs registration and ends above USD 1,000,000 annual revenue. Texts address use, distribution and outputs differently; none of this is legal clearance.
- articleAre there public, reported tests that compare the same seed across different GPU vendors, drivers or library versions for image diffusion, and what differences do they report?
No controlled cross-vendor or cross-driver pixel comparison for diffusion images was found in the sources searched. What exists are issue reports that touch the axes indirectly: CPU vs CUDA generator device on one GPU (diffusers 13298, Flux Schnell; maintainer: expected), MPS vs an RTX 5090 on the same graph where a second user could not reproduce the MPS failure on CUDA (ComfyUI 16879; the CUDA user also found CPU-fp16 vs GPU text encoder differ by MAD 0.6/255), an AMD gfx1100 INT8-attention failure producing noise that the default attention path avoids and that two users report fixed by comfy-kitchen 0.2.37 (ComfyUI 16711; library-version axis), and a video-model AMD thread where the reporter withdrew their first two causes (ComfyUI 15314). The maintainers' FAQ and A1111's option text claim CPU noise helps across vendors but show no test. The one cross-GPU-architecture paper found is about LLM token streams, not images.
- articleWhat public issue reports show the same seed and graph giving different images on one machine, what did the reporters measure, and what causes were identified or only suspected?
Five public threads, all reported_execution by their authors, show run-to-run or configuration-induced differences on one machine: batch size 1 vs 2 (diffusers 2659, three GPUs, SD 1.5), SDPA attention run-to-run (diffusers 3061), batch-size-dependent scheduler noise (diffusers 6222, resolved by per-image generators), fp8 + LoRA + dynamic VRAM (ComfyUI 15365, ~5-7/255 mean absolute difference, bit-identical without the LoRA, mechanism a hypothesis) and a cold-vs-warm server ordering effect on Apple MPS (ComfyUI 16879, pixel-identical within each state). Causes named by maintainers or reporters are claims; only the measured differences are the reporters' observations, and none was independently reproduced by us.
- articleRAP reports large planning gains from an LLM world model while Wang et al. find LLM state prediction unreliable; can the two be reconciled from the papers alone?
The two papers do not contradict each other because they measure different things on different tasks with different models, but the papers alone cannot say why RAP works. RAP (LLaMA-33B, frozen) reports plan success of 0.88 at 4 steps and 0.42 at 6 steps with 20 MCTS iterations on Blocksworld. LLM-Sim (GPT-4) reports 49.7-77.1% best-case on changing transitions of a different set of games. Reasons offered below are labelled synthesis; the sections read include no test that isolates them.
- articleWhen a paper says a language model is used "as a world model", what does the model actually do, and what did the authors measure for it?
In RAP (arXiv 2305.14992 v2) the world model is the same frozen LLM, prompted to write the next state as text after an action; a second prompt role proposes actions and a Monte Carlo Tree Search chooses among them. What RAP reports is downstream task success (Blocksworld plan success, GSM8k accuracy, PrOntoQA accuracy), not how often the LLM-written next state was correct. Do not read RAP as a measurement of state-prediction accuracy; Wang et al. (candidate -02) measure that separately.
- articleHow accurate was GPT-4 at predicting the next state of a text game, and which kinds of transitions (action-driven vs environment-driven, changing vs unchanged) failed?
Wang et al. (arXiv 2406.06485 v1) built ByteSized32-State-Prediction (76,369 transitions, 31 text games) and tested GPT-4 (gpt-4-0125-preview) and GPT-3.5 (gpt-3.5-turbo-0125), temperature 0, single-step with the ground-truth previous state supplied. Best GPT-4 accuracy on transitions where something changes was 59.9% for the whole transition; action-driven changes reached at most 77.1% and environment-driven changes at most 49.7%. Unchanged (static) transitions were easier; adding the game rules to the prompt helped; humans reached about 80% on a hard subset where GPT-4 was 50% by construction.
- articleWhich general.* metadata keys does the GGUF spec define for identity, provenance and licence, which are required, and how far can an agent trust them to establish a model's licence or lineage?
At ggml da8e2a54 the spec's 'Required' heading lists general.architecture, general.quantization_version and general.alignment, but the prose qualifies the latter two (quantization_version only if tensors are quantized; alignment defaults to 32). Identity and provenance keys (general.name, author, version, organization, basename, finetune, uuid, doi, url, repo_url, quantized_by, source.* and base_model.{id}.*) are recommended, not required. Licence is carried as general.license (an SPDX expression only, 'do not include any other information'), with optional general.license.name and general.license.link. These are self-declared strings written by whoever created the file; nothing in the spec says they are verified, so they are a lead for provenance, not licence evidence.
- articleCan an LLM serve as a judge of story or creative-writing quality, and how reliable and biased is it?
Two 2023 papers disagree. Chiang and Lee (text-davinci-003, ChatGPT) rated 200 human and 200 GPT-2 stories on four attributes and ranked human stories higher like English teachers, but per-story Kendall tau with teachers was only 0.12-0.43 and T0/text-curie-001 did not separate them. Chakrabarty et al. had GPT-3.5, GPT-4 and Claude v1.3 administer 14 creativity tests on 48 longer stories and found Cohen kappa with expert majority near zero (averages 0.016, 0.035, -0.006). Reported failure modes: score-level shifts between LLMs, refusal or low likability for violent content, sampling instability in small models; length bias is controlled by Chakrabarty but not measured in either paper.
- articleWhat is Dramatron, how does it generate a script, and what did 15 theatre and film professionals actually use it for?
Dramatron (DeepMind, Sept 2022) chains prompts hierarchically from a writer-supplied log line to title, characters, plot (scene beats), location descriptions and per-scene dialogue, using Chinchilla 70B with few-shot prompts; the writer can regenerate, continue or edit at every level. In a 2-hour paid study with 15 playwrights/screenwriters, writers used it mainly for inspiration, character/world alternatives and rough material, not finished scripts; five co-written scripts were staged at the 2022 Edmonton Fringe.
- articleFor video models sold as 'world simulators' (OpenAI Sora report, NVIDIA Cosmos), what is claimed versus measured, what fails, and what can an agent actually obtain and use?
OpenAI's 2024 report is a qualitative technical report: it describes a diffusion transformer over spacetime patches, shows emergent simulation behaviours, lists failures (glass shattering, object-state changes, incoherence in long samples), and states that model and implementation details are not included. NVIDIA's Cosmos paper (v3) describes diffusion and autoregressive 'world foundation models', measures 3D consistency (Sampson error, pose-estimation success) and a physics-alignment benchmark, reports that all models struggle with physics adherence, and releases weights under the NVIDIA Open Model License with Apache-2.0 code. The same word covers a closed qualitative report and an open measured platform.
- articleFor DreamerV3, MuZero, TD-MPC2 and V-JEPA 2 / V-JEPA 2-AC, what tasks, metrics, planning horizons and compute does each paper report?
All four papers train a learned predictive model and plan or train with it, but they demonstrate different things. DreamerV3 (arXiv v2): 150+ tasks across 8 domains with fixed hyperparameters, Minecraft diamonds from scratch in 100M environment steps, each agent on one A100, imagination horizon 15. MuZero (v2): Go/chess/shogi at 800 MCTS simulations and 57 Atari games at 50, K=5 unrolled steps, TPU pods. TD-MPC2 (v2): 104 continuous-control tasks, MPPI planning horizon 3, a 317M-parameter 80-task agent trained in 33 RTX 3090 GPU days. V-JEPA 2-AC (v1): zero-shot Franka-arm reach/grasp/pick-and-place by planning with image goals, planning horizon 1, post-trained on under 62 hours of Droid video.
- articleWhat exactly does LeCun's 2022 position paper propose as the world model module (JEPA, H-JEPA), and which parts are untested in that document?
Version 0.9.2 of LeCun's paper proposes a modular cognitive architecture in which a configurable world model predicts future world states in an abstract representation space, under uncertainty, and is trained by self-supervised learning with Joint Embedding Predictive Architectures (JEPA), including a hierarchical form (H-JEPA) for multi-scale planning. The paper explicitly prefers non-generative prediction in representation space over pixel-level generative prediction. It states it is a position paper, with no experiments reported in the sections inspected. Later experiments (V-JEPA 2) cite it as motivation but test only a part of the proposal.
- articleHow do common tools identify a model file (sha256, A1111 short hashes, ComfyUI/Hugging Face identifiers), and which identification survives renaming or re-saving?
Identifiers fall into three kinds. Name-based: ComfyUI prompts/workflows use the file name (ckpt_name), A1111's title includes the name. Whole-file content hashes: A1111 sha256 (short form = first 10 hex chars, used as 'Model hash'), InvokeAI and ComfyUI's asset store BLAKE3 ('blake3:<hex>'), Hugging Face LFS sha256 (also the ETag for LFS files) plus git blob ids and Xet hashes. Partial hashes: A1111's legacy 8-char hash (64 KiB at offset 1 MiB) and the kohya 'addnet' hash (data region after the header). Renaming keeps every content hash; any re-save that changes bytes (header/__metadata__ edit, different writer/ordering, dtype conversion) changes whole-file hashes; the addnet hash survives header-only edits only. None of the inspected tools defines a layout-independent tensor-content hash.
- articleHow accurate were licence labels on GitHub, Hugging Face and Papers with Code according to the Data Provenance Initiative audit, and how was that measured?
The 2023 Data Provenance audit re-traced licences for 1,858 datasets in 44 finetuning collections and reports that hosting-site labels are often missing (70%+) or wrong (50%+ error): GitHub, Hugging Face and Papers with Code matched the annotated licence 43%, 35% and 54% of the time and were too permissive 29%, 27% and 16% of the time. The authors call their protocol a best-effort check, not legal advice. An agent should not treat a hosting-site licence label as verified.
- articleWhat licence and provenance items do the Model Cards and Datasheets papers ask for, and are they requirements or suggestions?
Neither paper makes licence a mandatory field: the Model Cards paper lists License with 'License information can be provided' and says training data 'may not be possible to provide in practice' (minimal distribution details instead), and Datasheets for Datasets frames its licence and external-resource restriction questions as non-prescriptive. Both papers are distributed on arXiv under its non-exclusive licence, not an open content licence.
- articleWhich languages does SeamlessM4T v2 accept as speech or text input and produce as speech output, and do the card prose and the language table agree?
The SeamlessM4T v2 card's headline counts (101 speech input, 96 text, 35 speech output) are lower than its own language table (103 speech-source, 97 text-source, 97 text-target, 37 speech-target rows, including a cmn_Hant variant); an agent should check the table row for a specific language. Text coverage for the medium model is 200 languages via NLLB-200. Weights are CC BY-NC 4.0 (CA-B364).
- articleWhich dated Commission documents govern when a GPAI training-content summary is due, updated and enforced, including for models placed on the market before 2 August 2025 and for fine-tuned models?
Per the Commission's Notice and its 19 November 2025 Guidelines, the GPAI training-content summary obligation applies from 2 August 2025; models already on the market before then must publish by 2 August 2027, stating and justifying any information gaps; AI Office enforcement starts 2 August 2026; summaries are updated at six-month intervals or sooner when additional training materially changes them; a downstream modifier that becomes a provider covers only the modification data; the summary is required for all of a provider's models, and models meeting the open-source conditions are not exempt.
- articleHow do SPDX license-list versions, deprecated ids, exceptions (WITH) and LicenseRef-* work, and which media, data and model licences does the list include?
At SPDX License List 3.29.0 (740 licences, 32 deprecated, 86 exceptions) the media/data/model-relevant ids include the Creative Commons family (with NC, ND, SA variants), CC0-1.0, OFL-1.1 (with Font-exception-2.0), CDLA-Permissive-2.0, ODbL-1.0, OpenMDW-1.0 and Hippocratic-2.1; there is no SPDX id for Llama, Gemma or RAIL-family model licences, so those must be written as LicenseRef-<id>. WITH attaches an exception to a simple expression; operators are case-sensitive and ids case-insensitive.
- articleIn a Hugging Face model card, which licence and provenance fields are in the metadata spec, which are conditional, and which does the template leave as "More Information Needed"?
The Hub card spec lists license, license_name and license_link (the latter two only when license is other), with Optional/Required tags mainly on library_name and model-index fields; the annotated card leaves License untagged while marking Shared by and Finetuned From optional; the Python template fills a missing licence with '[More Information Needed]'; and the Hub licence page speaks of permissions for 'code or data', with no inspected statement that the license key governs model weights.
- articleFor use-restricted models, what can an agent read from Hugging Face licence metadata versus only from prose?
In a six-model sample (API, 2026-10-22) every model exposes licence metadata even when gated (manual or auto): a named id (llama3.3, gemma, bigscience-bloom-rail-1.0, creativeml-openrail-m) or license: other plus license_name (llama4; flux-1-dev-non-commercial-license with license_link LICENSE.md). The metadata names the licence only; restrictions such as user thresholds, naming duties or acceptable-use rules must be read in the licence text.
- articleWhat does model signing explicitly not cover, and which provenance claims (training data, licence, authorship of weights) must come from elsewhere?
OMS says signing is not a substitute for secure development and not a guarantee of quality, fairness or ethics; its v1.0 predicate carries only file digests and serialization settings, so training data, licence and model-card claims are not signed (model cards only as future work). The README's claim that signing enables 'the complete lineage of the model' is not supported by the v1.0 predicate structure.
- articleWhat do the NLLB-200 card and repository say about intended use, out-of-scope use, language count and licences, and can its translations be used for subtitles or dubbing scripts?
The NLLB-200 card scopes the model to research, sentence-level translation (inputs up to 512 tokens), not production, not document or domain-specific translation and not certified translation; weights are CC-BY-NC 4.0. The repository's FLORES-200 list has 202 codes against the '200 languages' label.
- articleWhat does the GPAI Code of Practice copyright chapter commit signatories to do about web crawling, robots.txt and other rights-reservation signals, and what must be public?
The Code's copyright chapter commits signatories to crawlers that follow robots.txt per RFC 9309 (and later IETF versions) and other appropriate machine-readable reservations by criteria, not to circumvent paywalls, and to exclude persistently infringing sites; it states that adherence is not compliance with EU copyright law.
- articleWhich EU GPAI documents make training-content information public, and which only go to the AI Office or downstream providers?
Public by obligation: the Art. 53(1)(d) training-content summary. Not public by default: Model Documentation (AI Office on request, downstream providers), whose public disclosure is only encouraged; a copyright-policy summary is encouraged public, while crawler information is a public commitment for Code signatories.
- articleI am a new agent: what does the European Commission's template for the public training-content summary of a general-purpose AI model actually ask a provider to publish, section by section?
The Commission's template for the Art. 53(1)(d) public summary (C(2025) 8311, 5 Dec 2025) has three sections (general information with modality size bands, list of data sources, data-processing aspects incl. opt-out measures and Code signatory status) and does not require disclosure of specific works; voluntary extra detail is allowed.
- articleWhere does the Model Documentation Form give the AI Office precise values but NCAs or downstream providers only coarse ones, and which items are downstream-only or regulator-only?
Several items are split into paired rows: the AI Office gets exact figures (parameters and training compute to at least two significant figures) while NCAs get ranges or orders of magnitude (parameter bands; FLOPs order of magnitude; training-duration bands); downstream-oriented items (integration means, hardware, software, licence, distribution to downstream providers) are DP-only. The output-modality row's mixed marks need careful reading.
- articleFor the EU Model Documentation Form, which columns say who gets the information (AI Office, national authorities, downstream providers) and how many fields go to each?
The EU GPAI Model Documentation Form marks each item for the AI Office, national competent authorities and/or downstream providers: downstream-provider items are to be provided proactively, AI Office/NCA items only on a reasoned AI Office request stating legal basis and purpose. About 44-45 rows carry audience marks (AIO about 35-36, NCA 33-34, DP 22-23, depending on how one two-line row is read).
- articleWhen a paper or product says 'world model', which of four different things does it mean, and what kind of evidence does each kind carry?
Primary sources use the term for at least four things: (1) latent dynamics models for control (Ha & Schmidhuber; DreamerV3), (2) a proposed predictive module in a cognitive architecture (LeCun 2022, a position paper with no experiments), (3) large video generators described as simulators (OpenAI 2024; NVIDIA Cosmos 'world foundation models'), and (4) action-controllable interactive-environment generators (Genie, trained from unlabelled video). Genie and Cosmos also present themselves under the 'world model' label. The sources differ in what they measured and in whether weights are released, so an agent should record sense, evidence class and access separately; 3D world generators were not covered by the sources inspected here.
- articleWhich open video models in ComfyUI are commercially usable and what hardware do the official templates assume (Wan 2.2, LTX-2.5)?
ComfyUI official tutorials (captured 2026-10-23): Wan2.2 models are Apache-2.0 and "support commercial use"; the hybrid Wan2.2-TI2V-5B (text+image to video) "should fit well on 8GB vram with the ComfyUI native offloading", with 14B variants for higher quality; templates use Comfy-Org repackaged weights. LTX-2.5 workflows (T2V, I2V, first-last-frame; optional prompt enhancer) need the latest ComfyUI and use gated Hugging Face repos (Lightricks/LTX-2.5 and a pixel-spatial-upscaler IC-LoRA), under the LTX-2.x community licence with a paid licence for entities >= $10M revenue (C3-B364-01); the Lightricks node README states 32 GB+ VRAM for its LTX-2 workflows (C3-B334-01). Docs warn that missing core nodes usually mean a stable release lags nightly. Takeaway for agents: Wan 2.2 5B is the low-VRAM, commercially clean local option; LTX/H3 need more VRAM and licence checks.
- articleHow can AI agents (Claude, ChatGPT, Codex, Cursor) drive ComfyUI via the official Comfy MCP, cloud vs local?
Comfy docs (captured 2026-10-23): Comfy MCP has two connections. Cloud: remote MCP at https://cloud.comfy.org/mcp (OAuth sign-in or an API key header; new users get 5 free runs), recommended for claude.ai/ChatGPT/Claude Desktop and for Mac users running large open models; setup via Claude Desktop custom connector, `claude mcp add --transport http comfy-cloud https://cloud.comfy.org/mcp`, or a "comfy-cloud" plugin from the Comfy Skills repo; Cursor lacks MCP OAuth, so use an API key. Local: open-source first-party comfy-mcp server wrapping comfy-cli (>= 1.14.0) to drive a local or self-deployed ComfyUI from coding agents. Tools include node/model/template search, a CQL graph-query tool for structural questions, importing shared workflows from comfy.org/workflows URLs, and an opt-in anonymized session summary (agent must ask first). Practical: this is the vendor-supported alternative to ad-hoc creator MCP setups (C3-B346-02, C3-B365-01) and pairs with the Cloud REST/websocket API (C3-...
- articleWhat does World Labs' Marble API cost per world, which models exist, and what can you export?
World Labs docs (captured 2026-10-23): API credits cost $1.00 per 1,250 credits (minimum $5), do not expire, and are separate from Marble web-app credits. Per world: Marble 1.0 Draft 150 credits (+80-100 for text/non-pano/multi-image/video pano step) = about $0.12-0.20; Marble 1.0/1.1 1,500 credits (+0-100) = about $1.20-1.28; Marble 1.1 Plus 1,500 base + 0-1,500 variable for larger worlds (observed through 2026-06-25: median $1.28, mean $1.71, max ~$2.48); HQ mesh export 3,500 credits (~$2.80). Requests may overdraw a low balance; overage is billed after the month ends. Docs recommend Marble 1.1 to start, Plus for the largest worlds. Export: in the web app, a paid plan is needed; Standard covers Gaussian-splat exports (SPZ and PLY), 360 panoramas and collider meshes for Unreal/Unity/Blender/Houdini; high-quality textured GLB mesh and commercial rights need Pro; Free can generate but not export. Crosslink: creator reports find Marble crisp but movement-restricted with no working ref...
- articleHow do quantised, fine-tuned or converted Hugging Face repos state their licence relative to the base model, and when does the repo give enough to identify the terms?
Derivative repos state licences in different ways: a bundled LICENSE plus NOTICE describing what was modified and which components carry other licences (FastVideo: MiniMax H3 Community licence, Apache-2.0 Qwen3-VL encoder), versus a README sentence that the model 'inherits the license of the base model' pointing to a local filesystem path (ovimxl), which cannot be resolved.
- articleBefore using a Hugging Face generation model, where do I look for its licence, what does the tag 'other' mean, and what will I usually find?
Hub docs ask for a LICENSE file and license_name when a repo uses 'license: other'; repos following this (e.g. JAM-0.5, whose LICENSE.md prohibits commercial use of the model or its outputs) are readable, while many LoRA/fine-tune repos carry only a tag that cannot be corroborated from the repo.
- articleWhen a C2PA soft-binding algorithm list entry (for example TrustMark or WavMark) points to an informationalUrl, does that page state a robustness evaluation or a licence?
The C2PA soft-binding algorithm list (5d5f99f9) has 54 entries and requires each informationalUrl to resolve to an algorithm-specific general description, without requiring robustness evidence or licence terms; TrustMark's README says MIT covers both code and the downloaded model files, while its LICENSE file opens with an Adobe 'All Rights Reserved' notice referring to 'the license agreement accompanying it' before the MIT text; WavMark's linked repository LICENSE is an MIT template with unfilled placeholders.
- articleWhen a model repository ships its own licence file under an OpenRAIL-M tag, does it match the canonical text, or has it been adapted or replaced?
ByteDance AnimateDiff-Lightning ships the OpenRAIL-M structure re-dated (March 19, 2024) with a different licensor (curator diff: copyright line, date and a trailing newline only); the Kimiko-v2-13B-GGUF repository ships a Llama 2 Community License file although its metadata tag is reported as creativeml-openrail-m, so tag and shipped file disagree.
- articleFor CreativeML OpenRAIL-M, is the licence text in the source-code repository identical to the text the weights model card links to?
The CompVis GitHub LICENSE (21f890f9), the HF Space licence.txt that the SD v1-4 card links (14d42d09) and a third-party GGUF repo LICENSE.md (101ff06c) are byte-identical CreativeML Open RAIL-M (dated 2022-08-22) texts; curator re-fetch reproduced the identical sha256.
- articleIs it safe to run ComfyUI with --listen, and what security controls does ComfyUI (v0.42.1) and ComfyUI-Manager (4.3) document?
At ComfyUI tag v0.42.1 (2026-10-19): the server binds 127.0.0.1:8188 by default; --listen with no value binds 0.0.0.0 and ::. SECURITY.md defines the threat model as local-only: anyone who can reach the URL is trusted, custom nodes are arbitrary trusted Python, and issues requiring --listen or other network exposure are treated as bugs, not vulnerabilities; securing an exposed server (firewall, reverse proxy, authentication) is the user's responsibility. cli_args.py offers TLS (--tls-keyfile/--tls-certfile), --enable-cors-header (default "*" when given without a value), --multi-user (per-user storage, not authentication), --disable-all-custom-nodes with --whitelist-custom-nodes, and --offline (restrictive CSP, disables partner nodes); no login/auth flag exists in that file. ComfyUI-Manager 4.3 config.ini: security_level strong|normal|normal-|weak and network_mode public|private|offline|personal_cloud; on non-local listeners high-risk features are blocked unless weak or personal_clou...
- articleWhat is Gemini Omni Flash in the Gemini API today (model id, capabilities)?
Google's Gemini API models page (captured 2026-10-23) lists Gemini Omni Flash with endpoint id gemini-omni-1.1-flash, described as "Fast video generation, editing, keyframe interpolation, and extension with native audio" (listed among image/video generation models next to Nano Banana Pro and Nano Banana 2 Lite; Imagen 4 marked shut down). This corrects secondary reports that the developer model is a "preview" id (gemini-omni-flash-preview): the current listed id is a 1.1 version without a preview suffix. A dedicated video-editing docs URL returned 404. Creator demo of its v2v editing: C3-B335-03.
- articleIf I drive ComfyUI from another machine or container (--listen, a tunnel, a reverse proxy), what does the server itself authenticate or restrict, and what must the agent's deployment add?
At the pin, the HTTP and WebSocket surface has no authentication in server.py and the project's threat model treats anyone who can reach the URL as trusted. The only built-in request filters are the origin-only middleware (blocks cross-site browser requests and, for loopback Hosts, Host/Origin mismatches) and path guards on /view and uploads. Passing --enable-cors-header replaces the origin-only middleware with a permissive CORS one, and --listen without a value opens all interfaces. An agent that exposes the port must add network controls, TLS and authentication outside ComfyUI.
- sourceTHUDM/ImageReward
- sourcetdrussell/diffusion-pipe
- sourceostris/ai-toolkit
- sourcenunchaku-ai/nunchaku (SVDQuant inference engine)
- sourceNerogar/OneTrainer
- sourceml-explore/mlx-examples
- sourcekohya-ss/sd-scripts
- sourcekohya-ss/musubi-tuner
- sourcehuggingface/safetensors
- sourcehuggingface/peft