How do I install Comfyui?

Comfyui is a local plugin. Install it using the provided package and add the generated configuration snippet to your AI app's MCP config file. Then restart your AI app.

Is Comfyui safe to use?

Comfyui was flagged by MCP Marketplace's security scan, scoring 3.8/10 (high risk). It has 6 high or critical findings to review. Review the security report on this page carefully before installing it.

What credentials does Comfyui need?

Comfyui requires the following credentials or environment variables: COMFYUI_URL, COMFYUI_PUBLIC_URL, MCP_AUTH_TOKEN. You can find setup instructions on the server detail page.

What AI apps work with Comfyui?

Comfyui uses the Model Context Protocol (MCP) and works with any MCP-compatible AI app, including Claude, ChatGPT / Codex, Gemini, Copilot, Cursor, and more.

Back to Browse

Comfyui MCP Server

by GermaniU

AI & MLUse Caution3.8Local

Free

MCP server that wraps ComfyUI (SDXL/Wan 2.2) for image and short-video generation.

About

MCP server that wraps ComfyUI (SDXL/Wan 2.2) for image and short-video generation.

Security Report

3.8

Use Caution3.8High Risk

The server is a straightforward wrapper that forwards tool calls to a local ComfyUI backend, with no hardcoded secrets, no user-controlled shell commands, and no data exfiltration patterns. The main concern is that authentication is opt-in: with MCP_AUTH_TOKEN unset, the HTTP server binds to 0.0.0.0 with CORS set to '*', so any LAN host or web page can trigger GPU-heavy generation. Lower-severity issues include unvalidated filename inputs and unpinned dependency ranges. Supply chain analysis found 10 known vulnerabilities in dependencies (1 critical, 5 high severity).

13 files analyzed · 17 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

HTTP Network Access

Connects to external APIs or services over the internet.

network_server

Check that this permission is expected for this type of plugin.

env_vars

Check that this permission is expected for this type of plugin.

process_spawn

Check that this permission is expected for this type of plugin.

What You'll Need

Set these up before or after installing:

Loopback URL of the ComfyUI engine. Inside a container 127.0.0.1 is the container itself, so point it at the host running ComfyUI (e.g. http://host.docker.internal:8188 or the LAN IP).Optional

Environment variable: COMFYUI_URL

LAN base URL used to build direct image download links.Optional

Environment variable: COMFYUI_PUBLIC_URL

Only applies when the container runs in HTTP mode. If set, every HTTP request must carry an Authorization: Bearer header.Required

Environment variable: MCP_AUTH_TOKEN

How to Install

Add this to your MCP configuration file:

{
  "mcpServers": {
    "io-github-germaniu-comfyui-mcp": {
      "env": {
        "COMFYUI_URL": "your-comfyui-url-here",
        "MCP_AUTH_TOKEN": "your-mcp-auth-token-here",
        "COMFYUI_PUBLIC_URL": "your-comfyui-public-url-here"
      },
      "args": [
        "comfyui-mcp"
      ],
      "command": "uvx"
    }
  }
}