registry / comfyui-mcp / 0.38.0

comfyui-mcp@0.38.0

Local-first, agent-native control plane for ComfyUI â€” MCP server + autonomous sidebar agent that drives your live graph in natural language on ANY LLM: Claude/ChatGPT/Gemini on your subscription (no API key), free local models via Ollama (fully offline)

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 17 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 236 file(s), 2.40 MB of source, external domains: 127.0.0.1, 192.168.1.20, abcd-8188.proxy.runpod.net, api.comfy.org, api.github.com, api.githubcopilot.com, api.kimi.com, api.moonshot.ai, api.openai.com, api.runpod.io, api.x.ai, api.x.ai.evil.com, api.z.ai, auth.example, auth.openai.com, auth.x.ai, chatgpt.com, civitai.com, cloud.comfy.org, comfyui-mcp.artokun.io, docs.comfy.org, evil.example, example.invalid, foo.x.ai, github.com, hub.docker.com, huggingface.co, mcp.civitai.com, ollama.com, openrouter.ai, platform.kimi.ai, raw.githubusercontent.com, registry.comfy.org, registry.npmjs.org, www.w3.org

Source & flagged code

9 flagged

package.jsonView file

Lines 24-64json

24 "dev:agent-poc": "tsx src/experimental/run.ts",

25 "start": "node dist/index.js",

26 "test": "vitest run --passWithNoTests",

27 "smoke": "npm run build && node scripts/smoke-install.mjs",

28 "test:watch": "vitest",

29 "test:integration": "cross-env COMFYUI_INTEGRATION=true vitest run",

30 "test:agent": "npm run build && node scripts/test-agent.mjs",

31 "test:local-llm": "npm run build && node scripts/test-local-llm.mjs",

32 "arena": "npm run build && node scripts/llm-arena.mjs",

33 "smoke:panel": "npm run build && node scripts/panel-smoke.mjs",

34 "lint": "tsc --noEmit",

35 "docs:gen": "cross-env COMFYUI_URL=http://127.0.0.1:8188 tsx scripts/gen-tool-docs.ts",

36 "runpod:release": "node scripts/runpod-release.mjs",

37 "runpod:release:major": "node scripts/runpod-release.mjs major",

38 "packs:gen": "node scripts/gen-pack-installers.mjs",

39 "packs:validate": "node scripts/validate-manifests.mjs",

40 "packs:test": "bash scripts/test-packs.sh",

41 "packs:check-urls": "node scripts/check-model-urls.mjs",

42 "packs:check-models": "node scripts/check-pack-models.mjs",

43 "packs:verify-render": "node scripts/verify-render.mjs",

44 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L44

45 "generations:stats": "node scripts/generation-stats.mjs",

46 "release": "npm version patch && git push --follow-tags",

47 "release:minor": "npm version minor && git push --follow-tags",

48 "release:major": "npm version major && git push --follow-tags",

49 "changelog": "node scripts/gen-changelog.mjs",

50 "version": "node scripts/gen-changelog.mjs --from-pkg && git add CHANGELOG.md",

51 "prepare": "tsc"

52 },

53 "dependencies": {

54 "@modelcontextprotocol/sdk": "^1.12.1",

55 "@stable-canvas/comfyui-client": "^1.5.9",

56 "better-sqlite3": "^12.6.2",

57 "dotenv": "^16.4.7",

58 "sharp": "^0.34.5",

59 "ws": "^8.21.0",

60 "yaml": "^2.9.0",

61 "zod": "^4.0.0"

62 },

63 "optionalDependencies": {

64 "@anthropic-ai/claude-agent-sdk": "^0.3.197",

dist/services/node-management.jsView file

Lines 1-21javascript

1import { execFileSync } from "node:child_process";

2import { createHash, randomUUID } from "node:crypto";

High

Child Process

Package source references child process execution.

dist/services/node-management.jsView on unpkg · L1

3import { existsSync } from "node:fs";

dist/services/env-capabilities.jsView file

Lines 1-26javascript

1// Live ENVIRONMENT-CAPABILITIES probe for the panel orchestrator.

2//

3// Gathered ONCE at orchestrator startup (or lazily on the first tab) and CACHED,

4// then prepended as a compact one-line block to the panel agent's system prompt

5// so the agent is immediately aware of the machine — no probing, no guessing.

6//

7// Every probe is best-effort and time-bounded: a hung ComfyUI, a slow PowerShell,

8// or a missing python must NEVER stall session start. Each field degrades to

High

Shell

Package source references shell execution.

dist/services/env-capabilities.jsView on unpkg · L6

dist/utils/optional-dep.jsView file

Lines 1-29javascript

1// Helper for lazy-loading optional dependencies.

2//

3// Heavy or feature-gated packages (cloud SDKs, AI SDKs, cloudflared) live in

4// `optionalDependencies` so a `npm install --no-optional comfyui-mcp` install

5// still yields a working server. The features that need those deps surface a

6// clear "install <pkg>" error instead of crashing on import.

7import { ModelError } from "./errors.js";

8const cache

dist/services/crash-log.jsView file

Lines 171-211javascript

171 let chosenMtime = -Infinity;

172 for (const p of candidates) {

173 try {

174 const m

scripts/codex-parity-smoke.mjsView file

Lines 1-32javascript

1// CODEX PARITY SMOKE — proves the Codex backend has FULL tool parity with Claude.

2//

3// Starts a codex-mode orchestrator (PANEL_AGENT_BACKEND=codex) on a test bridge

4// port + a headless mock-panel that implements the graph executors, then drives a

5// turn and asserts Codex actually invokes the panel_* tools over the loopback

6// HTTP MCP (not shell/HTTP flailing). Records every bridge command the agent

7// issued.

8//

9// node scripts/codex-parity-smoke.mjs

10//

dist/services/self-update.jsView file

Lines 1-41javascript

1// Self-update for the comfyui-mcp npm package.

2//

3// On MCP server START we check the npm registry; if a newer version is

4// published we auto-update the on-disk package, then tell the agent/user to

5// RECONNECT — the running Node process cannot hot-swap its own code, so the new

6// version only takes effect after the MCP client reconnects (/mcp) or the

7// orchestrator restarts.

8//

9// This mirrors the SAFETY model of the panel on-load ensure

10// (src/services/panel-installer.ts):

packs/qwen-image-edit-edit/install-windows.batView file

•path = packs/qwen-image-edit-edit/install-windows.bat kind = build_helper sizeBytes = 3162 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

packs/qwen-image-edit-edit/install-windows.batView on unpkg

dist/orchestrator/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = comfyui-mcp@0.37.0 matchedIdentity = npm:Y29tZnl1aS1tY3A:0.37.0 similarity = 0.958 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/orchestrator/index.jsView on unpkg

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code