The core policy puts --listen and non-default exposure out of scope and assumes local use, while comfyui-api and comfy-pack exist to expose workflows as HTTP services and the 2026 botnet targeted exposed instances. What authentication, sandboxing and node allow-list design is the baseline for an agent-facing recipe service?
Why this is still open: Security policy and wrappers are written from different assumptions; no source gives a vetted reference architecture.