MCP Observatory
3m ago Tracked 59,480 Last 3m ago 24h 2,586
npm JavaScript analyzed 0.52.203 deep scan · partial (107/1,186 files)

comfyui-mcp

v0.52.203
npm

Local-first, agent-native control plane for ComfyUI — MCP server + autonomous sidebar agent that drives your live graph in natural language on ANY LLM: Claude/ChatGPT/Gemini on your subscription (no API key), free local models via Ollama (fully offline),

maintainer
artokun
licence
MIT
first seen
2026-06-12
last seen
2026-09-17
releases · 30d
387
short id

Drift inferred · capture-to-capture

  1. HIGH code analysis flagged hidden prompt content in comfyui-mcp
  2. HIGH code analysis flagged hidden prompt content in artokun/comfyui-mcp
  3. HIGH code analysis flagged hidden prompt content in comfyui-mcp
capabilities 36 tools
transport stdio · streamable-http · http verified reported listed in the official MCP registry counts 36 tools · 0 res · 0 prompts permission surface via code analysis

tools

  • apps
  • batch
  • bisect
  • calculate
  • clear_vram
  • comfy_cli
  • create_workflow
  • download_model
  • enqueue_workflow
  • generate_image
  • get_defaults
  • get_history
  • get_image
  • get_system_stats
  • get_workflow
  • install_comfyui
  • install_custom_node
  • kitchen
  • list_api_nodes
  • list_local_models
  • list_packs
  • model_metadata
  • node_snapshot
  • queue
  • report_issue
  • restart_comfyui
  • runpod
  • runpod_watch
  • save_workflow
  • search_custom_nodes
  • train_doctor
  • train_prepare_dataset
  • train_start
  • upload_image
  • visualize_workflow
  • workspace
skills & danger signals npm-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed v0.52.203 · analyzer v33 · 1w ago

skills & prompt files 40

code evidence v0.52.203 · npm-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 478

filesystem 150

  • fs package/dist/config.js :4 import { chmodSync, copyFileSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
  • fs package/dist/env-file.js :18 import { existsSync, readFileSync } from "node:fs";
  • fs package/dist/i18n/index.js :26 import { readFileSync, existsSync } from "node:fs";
  • fs package/dist/orchestrator/antigravity-backend.js :64 import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
  • fs package/dist/orchestrator/backend-readiness.js :11 import { existsSync, readFileSync } from "node:fs";
  • fs package/dist/orchestrator/blind-native-gate.js :25 import { openSync, readSync, closeSync } from "node:fs";
  • fs package/dist/orchestrator/chatgpt-oauth-backend.js :3 import { readFile } from "node:fs/promises";
  • fs package/dist/orchestrator/codex-backend.js :41 import { copyFileSync, existsSync, mkdirSync, promises as fsp } from "node:fs";
  • fs package/dist/orchestrator/grok-backend.js :63 import { existsSync } from "node:fs";
  • fs package/dist/orchestrator/history.js :13 import { readdir, readFile, stat } from "node:fs/promises";
  • fs package/dist/orchestrator/index.js :11 import { existsSync, mkdirSync, writeFileSync, unlinkSync, readFileSync, readdirSync, rmSync, appendFileSync, } from "node:fs";
  • fs package/dist/orchestrator/ollama-backend.js :16 import { mkdirSync, writeFileSync } from "node:fs";
show 28 more
  • fs package/dist/orchestrator/pair-token-store.js :21 import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
  • fs package/dist/orchestrator/pair-update-prefs.js :13 import { existsSync, mkdirSync, readFileSync } from "node:fs";
  • fs package/dist/orchestrator/panel-console-http.js :8 import { createReadStream, existsSync } from "node:fs";
  • fs package/dist/orchestrator/panel-screenshot-persist.js :7 import { closeSync, constants, copyFileSync, existsSync, fsyncSync, lstatSync, mkdirSync, openSync, renameSync, rmSync, writeFileSync, } from "node:fs";
  • fs package/dist/orchestrator/panel-tools.js :30 import { existsSync, lstatSync, readdirSync, readFileSync, realpathSync, statSync } from "node:fs";
  • fs package/dist/orchestrator/pi-backend.js :57 import { existsSync, readFileSync } from "node:fs";
  • fs package/dist/orchestrator/pi-credentials.js :29 import { readFileSync, statSync } from "node:fs";
  • fs package/dist/orchestrator/run-completion-idempotency.js :1 import { existsSync, mkdirSync, readFileSync } from "node:fs";
  • fs package/dist/orchestrator/session-store.js :1 import { existsSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from "node:fs";
  • fs package/dist/orchestrator/turn-registry.js :29 import { mkdirSync, readdirSync, readFileSync, rmSync, statSync } from "node:fs";
  • fs package/dist/services/agent-identity.js :33 import { mkdirSync, renameSync, readFileSync, writeFileSync } from "node:fs";
  • fs package/dist/services/agent-setup.js :1 import { promises as fs } from "node:fs";
  • fs package/dist/services/ai-toolkit.js :10 import { existsSync, readFileSync } from "node:fs";
  • fs package/dist/services/batch-manager.js :4 import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
  • fs package/dist/services/bridge-port-reclaim.js :13 import { readFileSync } from "node:fs";
  • fs package/dist/services/checkpoint-capability.js :21 import { open, stat } from "node:fs/promises";
  • fs package/dist/services/code-provider-auth.js :1 import { readFile, writeFile, rename, mkdir } from "node:fs/promises";
  • fs package/dist/services/color-analysis.js :1 import { readFile } from "node:fs/promises";
  • fs package/dist/services/comfy-cli.js :2 import { existsSync } from "node:fs";
  • fs package/dist/services/comfy-view-ref.js :52 import { constants as fsConstants } from "node:fs";
  • fs package/dist/services/crash-log.js :17 import { existsSync, readFileSync, statSync } from "node:fs";
  • fs package/dist/services/defaults-manager.js :1 import { readFile, writeFile, mkdir, rename } from "node:fs/promises";
  • fs package/dist/services/desktop-launch-args.js :1 import { existsSync, readFileSync, statSync } from "node:fs";
  • fs package/dist/services/download-cache.js :2 import { createWriteStream, constants as fsConstants } from "node:fs";
  • fs package/dist/services/download-jobs.js :17 import { realpath } from "node:fs/promises";
  • fs package/dist/services/download-progress.js :11 import { mkdirSync, readFileSync, readdirSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
  • fs package/dist/services/download-segments.js :45 import { open, rename, rm, truncate } from "node:fs/promises";
  • fs package/dist/services/download-volume.js :36 import { statfs } from "node:fs/promises";

110 more not shown — this panel samples each group; the count above is the real total.

shell / exec 52

  • shell package/dist/orchestrator/antigravity-backend.js :52 import { spawn, spawnSync } from "node:child_process";
  • shell package/dist/orchestrator/codex-backend.js :39 import { spawn, spawnSync } from "node:child_process";
  • shell package/dist/orchestrator/gemini-backend.js :63 import { spawn, spawnSync } from "node:child_process";
  • shell package/dist/orchestrator/grok-backend.js :60 import { spawn, spawnSync } from "node:child_process";
  • shell package/dist/orchestrator/index.js :13 import { execFileSync } from "node:child_process";
  • shell package/dist/orchestrator/panel-agent.js :2168 /** Per-tab session id to resume on the next spawn (reload restore). */
  • shell package/dist/orchestrator/pi-backend.js :56 import { spawn, spawnSync } from "node:child_process";
  • shell package/dist/orchestrator/qwen-backend.js :57 import { spawn, spawnSync } from "node:child_process";
  • shell package/dist/services/ai-toolkit.js :9 import childProcess from "node:child_process";
  • shell package/dist/services/bridge-port-reclaim.js :12 import { execFileSync } from "node:child_process";
  • shell package/dist/services/comfy-cli.js :1 import * as childProcess from "node:child_process";
  • shell package/dist/services/download-proxy.js :1 import { execFile } from "node:child_process";
show 28 more
  • shell package/dist/services/env-capabilities.js :16 import { execFile } from "node:child_process";
  • shell package/dist/services/install-comfyui.js :1 import { execSync, spawnSync } from "node:child_process";
  • shell package/dist/services/kitchen.js :8 import { execFile } from "node:child_process";
  • shell package/dist/services/launcher-env.js :6 * reconstructed the launch ENVIRONMENT: `spawn()` with no `env` option inherits
  • shell package/dist/services/live-interpreter.js :27 import { execFileSync } from "node:child_process";
  • shell package/dist/services/lmstudio-lifecycle.js :17 import { execFile } from "node:child_process";
  • shell package/dist/services/manifest.js :1 import { execFileSync } from "node:child_process";
  • shell package/dist/services/node-authoring.js :1 import { spawnSync } from "node:child_process";
  • shell package/dist/services/node-dev.js :1 import { spawnSync } from "node:child_process";
  • shell package/dist/services/node-management.js :1 import { execFileSync } from "node:child_process";
  • shell package/dist/services/oauth-flow.js :67 const { spawn } = await import("node:child_process");
  • shell package/dist/services/panel-installer.js :22 import { execFileSync } from "node:child_process";
  • shell package/dist/services/panel-launcher.js :11 import { execFileSync, spawn } from "node:child_process";
  • shell package/dist/services/panel-pin-guard.js :26 import { execFileSync } from "node:child_process";
  • shell package/dist/services/port-owner.js :8 import { execSync } from "node:child_process";
  • shell package/dist/services/process-control.js :1 import { exec, execSync, spawn, } from "node:child_process";
  • shell package/dist/services/runpod-ssh.js :10 import childProcess from "node:child_process";
  • shell package/dist/services/self-restart.js :38 import { spawn } from "node:child_process";
  • shell package/dist/services/self-update.js :30 import { execFile, spawn } from "node:child_process";
  • shell package/dist/services/storage/hf.js :1 import { execFile } from "node:child_process";
  • shell package/dist/services/trainer-bootstrap.js :9 import childProcess from "node:child_process";
  • shell package/dist/services/update-comfyui.js :1 import { execFileSync } from "node:child_process";
  • shell package/dist/services/workspace-env.js :1 import { execFile } from "node:child_process";
  • shell package/plugin/hooks/open-latest-image.mjs :12 import { execSync } from "node:child_process";
  • shell (weak) package/plugin/scripts/launch-server.mjs :61 import { execFile, spawn } from "node:child_process";
  • shell (weak) package/scripts/check-anti-slop.mjs :61 import { spawnSync } from "node:child_process";
  • shell (weak) package/scripts/check-blog-staleness.mjs :33 import { execFileSync } from 'node:child_process';
  • shell (weak) package/scripts/check-changelog.mjs :42 import { execFileSync } from "node:child_process";

12 more not shown — this panel samples each group; the count above is the real total.

network 56

  • net package/dist/comfyui/client.js :113 return await client.fetch(client.apiURL(route), {
  • net package/dist/comfyui/cloud-client.js :48 const res = await fetch(url, { ...init, headers, signal });
  • net package/dist/comfyui/fetch.js :623 return fetch(target, requestInit);
  • net package/dist/config.js :6 import { isIP } from "node:net";
  • net package/dist/experimental/agent-poc.js :2 import { createServer } from "node:http";
  • net package/dist/orchestrator/chatgpt-oauth-backend.js :161 res = yield* sendWithRateLimitRetry(() => fetch(CODEX_RESPONSES_URL, {
  • net package/dist/orchestrator/claude-backend.js :337 const res = await fetch(u, { signal: AbortSignal.timeout(15000) });
  • net package/dist/orchestrator/codex-backend.js :1090 const res = await fetch(u, { signal: AbortSignal.timeout(15000) });
  • net package/dist/orchestrator/gemini-backend.js :493 const res = await fetch(u, { signal: AbortSignal.timeout(15000) });
  • net package/dist/orchestrator/grok-backend.js :546 const res = await fetch(u, { signal: AbortSignal.timeout(15000) });
  • net package/dist/orchestrator/ollama-backend.js :757 const res = await fetch(`${this.host}/models`, {
  • net package/dist/orchestrator/panel-console-http.js :9 import { createServer } from "node:http";
show 28 more
  • net package/dist/orchestrator/panel-mcp-http.js :18 import { createServer } from "node:http";
  • net package/dist/orchestrator/qwen-backend.js :465 const res = await fetch(u, { signal: AbortSignal.timeout(15000) });
  • net package/dist/services/civitai-resolver.js :67 return await fetch(url, {
  • net package/dist/services/download-cache.js :543 * `application/octet-stream`. (fetch() transparently decompresses gzip/br, so a
  • net package/dist/services/download-proxy.js :2 import { isIP } from "node:net";
  • net package/dist/services/env-capabilities.js :180 // /system_stats fetch (direct HTTP — no client dependency, mirrors the environment read)
  • net package/dist/services/llamacpp-probe.js :20 const res = await fetch(`${serverRoot(host)}/props`, { signal: AbortSignal.timeout(4000) });
  • net package/dist/services/lmstudio-lifecycle.js :44 const res = await fetch(`${serverRoot(host)}/api/v0/models`, {
  • net package/dist/services/model-resolver.js :177 // zero-length array as "nothing found". Only errors thrown by fetch() itself
  • net package/dist/services/oauth-flow.js :7 import { createServer } from "node:http";
  • net package/dist/services/ollama-vram.js :24 const res = await fetch(`${host}/api/ps`, { signal: AbortSignal.timeout(4000) });
  • net package/dist/services/panel-image-relay.js :4 import { createServer } from "node:http";
  • net package/dist/services/panel-launcher.js :12 import { createServer, request as httpRequest } from "node:http";
  • net package/dist/services/panel-template-relay.js :4 import { createServer } from "node:http";
  • net package/dist/services/process-control.js :4 import { isIP } from "node:net";
  • net package/dist/services/registry-client.js :32 // "the pack does not exist". Only errors thrown by fetch() itself take this
  • net package/dist/services/runpod-client.js :76 res = await fetch(RUNPOD_GRAPHQL_ENDPOINT, {
  • net package/dist/services/self-update.js :51 res = await fetch(url, {
  • net package/dist/services/skill-generator.js :61 const res = await fetch(url, {
  • net package/dist/services/storage/http.js :24 const response = await fetch(destination.url, init);
  • net package/dist/services/userdata-library.js :95 return await client.fetch(url, {
  • net package/dist/services/workflow-url.js :219 res = await fetch(u, {
  • net package/dist/tools/apps.js :68 const res = await fetch(url, {
  • net package/dist/tools/image-management.js :318 const filename = requireField(args.filename, "get", "filename", 'the output filename to fetch (from get_history or action:"list_outputs")');
  • net package/dist/tools/missing-models.js :46 const res = await fetch(`https://huggingface.co/api/models/${path}/tree/main`, {
  • net package/dist/tools/model-explorer.js :56 const res = await fetch(`https://civitai.com/api/v1/model-versions/${versionId}`, {
  • net package/dist/tools/runpod.js :80 const res = await fetch(url, { signal: ctl.signal });
  • net package/dist/tools/template-schema.js :335 const res = await fetch(url, {

16 more not shown — this panel samples each group; the count above is the real total.

secrets 18

  • secrets package/dist/config.js :518 const cloudApiKey = process.env.COMFYUI_API_KEY?.trim() || undefined;
  • secrets package/dist/experimental/agent-poc.js :96 process.env.COMFYUI_MCP_AGENT_TOKEN ??
  • secrets package/dist/orchestrator/backend-readiness.js :284 const apiKey = process.env.KIMI_API_KEY?.trim();
  • secrets package/dist/orchestrator/gemini-backend.js :607 if (process.env.GEMINI_API_KEY?.trim()) {
  • secrets package/dist/orchestrator/index.js :820 delete process.env.ANTHROPIC_API_KEY;
  • secrets package/dist/orchestrator/kimi-backend.js :10 const apiKey = process.env.KIMI_API_KEY?.trim() || "pending-oauth";
  • secrets package/dist/services/code-provider-auth.js :531 const apiKey = process.env.KIMI_API_KEY?.trim();
  • secrets package/dist/services/manifest-outcome-channel.js :40 return process.env.COMFYUI_MCP_MANIFEST_OUTCOME_SECRET?.trim() ?? "";
  • secrets package/dist/services/panel-image-relay.js :1114 const secret = process.env.COMFYUI_MCP_RELAY_SECRET;
  • secrets package/dist/services/panel-template-relay.js :801 const secret = process.env.COMFYUI_MCP_RELAY_SECRET;
  • secrets package/dist/services/secure-bridge.js :233 accessKey: process.env.COMFYUI_MCP_RELAY_KEY?.trim() || undefined,
  • secrets package/dist/services/storage/azure-blob.js :63 const key = process.env.AZURE_STORAGE_KEY;
show 6 more
  • secrets package/dist/services/storage/index.js :42 const secretAccessKey = s3?.secret_access_key ?? process.env.AWS_SECRET_ACCESS_KEY ?? "";
  • secrets package/dist/services/storage/s3.js :41 const secretAccessKey = auth?.secret_access_key ?? process.env.AWS_SECRET_ACCESS_KEY;
  • secrets package/dist/tools/missing-models.js :49 // reading process.env.HF_TOKEN directly made a token saved after this
  • secrets (weak) package/scripts/panel-smoke.mjs :43 ...(process.env.OPENROUTER_API_KEY
  • secrets (weak) package/scripts/probe-models.mjs :5 delete process.env.ANTHROPIC_API_KEY;
  • secrets (weak) package/scripts/runpod-release.mjs :117 let key = process.env.RUNPOD_API_KEY;

database 2

  • db package/dist/services/generation-tracker.js :5 import BetterSqlite3 from "better-sqlite3";
  • db (weak) package/scripts/generation-stats.mjs :9 import Database from "better-sqlite3";

tool registrations 36

  • list_api_nodes package/dist/tools/api-nodes.js :27
  • apps package/dist/tools/apps.js :102
  • batch package/dist/tools/batches.js :24
  • calculate package/dist/tools/calculate.js :25
  • comfy_cli package/dist/tools/comfy-cli.js :45
  • get_defaults package/dist/tools/defaults.js :43
  • get_history package/dist/tools/diagnostics.js :281
  • generate_image package/dist/tools/generate-image.js :97
  • get_image package/dist/tools/image-management.js :189
  • upload_image package/dist/tools/image-management.js :800
  • install_comfyui package/dist/tools/install-comfyui.js :62
  • kitchen package/dist/tools/kitchen.js :114
show 24 more
  • clear_vram package/dist/tools/memory-management.js :116
  • model_metadata package/dist/tools/model-explorer.js :256
  • download_model package/dist/tools/model-management.js :343
  • list_local_models package/dist/tools/model-management.js :561
  • bisect package/dist/tools/node-bisect.js :21
  • install_custom_node package/dist/tools/node-management.js :249
  • node_snapshot package/dist/tools/node-snapshots.js :21
  • restart_comfyui package/dist/tools/process-control.js :21
  • queue package/dist/tools/queue-management.js :24
  • search_custom_nodes package/dist/tools/registry-search.js :37
  • report_issue package/dist/tools/report-issue.js :429
  • runpod package/dist/tools/runpod.js :136
  • runpod_watch package/dist/tools/runpod.js :509
  • list_packs package/dist/tools/skills-access.js :410
  • get_system_stats package/dist/tools/system-stats.js :38
  • train_prepare_dataset package/dist/tools/train.js :128
  • train_start package/dist/tools/train.js :275
  • train_doctor package/dist/tools/train.js :509
  • create_workflow package/dist/tools/workflow-compose.js :92
  • enqueue_workflow package/dist/tools/workflow-execute.js :49
  • get_workflow package/dist/tools/workflow-library.js :336
  • save_workflow package/dist/tools/workflow-library.js :508
  • visualize_workflow package/dist/tools/workflow-visualize.js :64
  • workspace package/dist/tools/workspace-env.js :22

install hooks 1

  • prepare package/package.json :58 tsc

declared dependencies 28

  • @modelcontextprotocol/sdk@~1.30.0
  • @comfyorg/sdk@^0.1.7
  • @stable-canvas/comfyui-client@^1.5.9
  • better-sqlite3@^13.0.3
  • dotenv@^17.4.2
  • sharp@^0.35.3
  • undici@7.29.0
  • ws@^8.21.3
  • yaml@^2.9.0
  • zod@^4.0.0
  • @oxlint/plugins@1.79.0
  • @types/better-sqlite3@^7.6.13
show 16 more
  • @types/node@^22.13.4
  • @types/ws@^8.18.1
  • cross-env@^10.1.0
  • oxlint@1.79.0
  • tsx@^4.23.12
  • typescript@^7.0.2
  • vitest@^4.1.11
  • @ai-sdk/anthropic@^4.0.41
  • @ai-sdk/google@^4.0.50
  • @ai-sdk/openai@^4.0.46
  • @anthropic-ai/claude-agent-sdk@^0.3.240
  • @aws-sdk/client-s3@^3.1116.0
  • @azure/storage-blob@^12.33.0
  • @openai/codex@0.149.0
  • ai@^7.0.77
  • cloudflared@^0.7.3

obfuscation 1

  • dynamic require()/import() package/scripts/smoke-install.mjs :238 const { loadOrCreatePairToken } = await import(P + "/orchestrator/pair-token-store.js");

perm:untrusted 2

  • untrusted (weak) package/scripts/test-generate.mjs :49 const h = await fetch(`${COMFYUI_URL}/history/${pid}`).then((r) => r.json()).catch(() => ({}));
  • untrusted (weak) package/scripts/verify-render.mjs :42 const objectInfo = await fetch(`${COMFY}/object_info`).then((r) => r.json());