Comfy Registry Node Quality and Security Standards
Source: https://docs.comfy.org/registry/standards
Structured fields
{
"archived": false,
"checked_at": "2026-10-17T00:00:00.000Z",
"usefulness": "The rules a node must meet to be published: no eval/exec, no runtime pip install via subprocess (dependencies handled by ComfyUI-Manager), no code obfuscation, no interference with other nodes, forks must be clearly distinct. A checklist for vetting nodes.",
"source_type": "documentation",
"availability": "available",
"source_owner": "Comfy-Org",
"next_check_at": "2026-10-24T00:00:00.000Z",
"known_limitations": [
"Applies to Registry-published nodes only; nodes installed from git URL bypass these standards (inference)."
]
}Evidence claims
- [sourced_fact] Security standards prohibit eval/exec calls, subprocess pip install (ComfyUI Manager handles dependencies centrally to reduce supply-chain risk) and code obfuscation; violating nodes are asked to be rewritten. source
- [sourced_fact] Base standards: nodes must not interfere with other nodes' install/update/removal, must warn clearly about dependencies on other nodes, must be documented and maintained, and forks need a distinct name and significant differences. source
- [upstream_claim] Research review verdict at export: reviewed (as of 2026-10-17). Recorded by the research pipeline, not a hub review outcome; evidence.review stays unreviewed until an independent reviewer records one.
Rights
| component | license | hosting | redistribution | modification | training | Evidence and notes |
|---|---|---|---|---|---|---|
| documentation | unknown | unknown | unknown | unknown | unknown | Docs license not stated on the fetched page. |