ComfyUI MCP servers compared: comfyui-mcp, comfy-mcp and comfyui-mcp-secure in Claude Code, measured for ports, paths, tokens

If you want the widest feature set, pick comfyui-mcp; for official support, comfy-mcp; for the least exposure of your local file system, comfyui-mcp-secure. Run with their default stdio transport, none of the three opens a single port, so the real differences are how far each one reads and writes local files and how much model context its tool definitions consume.

This is for anyone about to connect a local ComfyUI to Claude Code. On 2026-10-28 I installed all three servers at pinned versions and measured them. The client was Claude Code 2.1.312 on macOS 27.0.1, and ComfyUI was 0.35.0 on the same Mac. Only the first-generation run used ComfyUI 0.33.1 on a Windows machine with an RTX 5090. I run this blog's own workflow with several MCP servers attached to Claude Code and Codex.

The security section is written from the defender's side only: whether your setup is affected, which versions and settings to change, and where to look for traces. Every test ran on the loopback interface of my own two machines and inside freshly created empty folders.

comfyui-mcp, comfy-mcp and comfyui-mcp-secure aim at different things

These three are not rivals doing the same job. They split into maximum features, official, and security-focused. The table below shows values I checked on 2026-10-28 through the GitHub API and the package registries; star counts and release dates are as of that day.

Repository	Package (measured version)	Language, license	Stars	Last release	Tools
artokun/comfyui-mcp	npm comfyui-mcp@0.52.206	TypeScript, MIT	871	2026-10-14	41
Comfy-Org/comfy-mcp	PyPI comfy-mcp==0.10.0	Python, AGPL-3.0 OR Commercial	308	2026-08-10	39
hybridindie/comfyui_mcp	PyPI comfyui-mcp-secure==2.3.0	Python, MIT	3	2026-10-06	53

comfyui-mcp is the largest community server. It bundles a Claude Code plugin, hooks, and --http and --tunnel modes in one package. The README says 38 tools, but the actual handshake returned 41.

comfy-mcp is the official server that Comfy-Org created in 2026-07. It does not open its own socket to ComfyUI; it shells out to comfy-cli instead. PyPI 0.10.0 is 47 commits behind main. The README's quick start also installs from a checkout rather than from PyPI.

comfyui-mcp-secure is a small server with 3 stars. Its selling points are workflow inspection, a path sanitizer and an audit log. Peleke/comfyui-mcp was also a candidate, but I dropped it: 2 stars and no pushes since 2026-03-13.

With the default stdio transport, none of the three opens a port

I started each server with its defaults and counted LISTEN sockets across its process tree. All three had zero. A stdio server is spawned by Claude Code as a child process and talks only over pipes. Here is the log:

## stdio 기본 — artokun comfyui-mcp@0.52.206
  LISTEN (none)
## stdio 기본 — comfy-mcp 0.10.0
  LISTEN (none)
## stdio 기본 — comfyui-mcp-secure 2.3.0
  LISTEN (none)

(The stdio 기본 headers are my log labels and mean "stdio default".)

Only two of them have an HTTP mode. comfyui-mcp --http bound to 127.0.0.1:9100. comfyui-mcp-secure with transport.remote.enabled bound to 127.0.0.1:8080. comfy-mcp is hard-coded to stdio.

Request	comfyui-mcp --http	comfyui-mcp-secure remote
No token	200	200
Unfamiliar Origin header	200	200
No token or wrong token, after setting COMFYUI_MCP_HTTP_TOKEN	401	no such setting
Correct token, same setting	200	no such setting

An HTTP mode without a token is an open door, even on loopback. The transport section of the MCP specification, 2025-11-25 revision, says servers must validate the Origin header and return 403 when it is wrong. Started without a token, both servers answered 200 to an unfamiliar Origin.

There is already a case that shows why this matters. CVE-2026-61568 in @zereight/mcp-gitlab was a flaw that let DNS rebinding reach its local Streamable HTTP transport; it was fixed in 2.1.30. It shows that an HTTP server bound to loopback can still be reached through a browser. I did not test whether the same path works against these two servers.

One more thing caught me. The default port of comfyui-mcp, 9100, is one that printers commonly use. On my Mac, a printer driver was already holding *:9100. Requests to 127.0.0.1:9100 did reach the MCP server, but changing the port with --port saves you the confusion.

comfyui-mcp and comfy-mcp read and write outside ComfyUI, even on the Desktop

I passed a freshly created ~/Desktop/mcp-scope-test/ path to the upload and output-path tools listed in the table below. comfyui-mcp and comfy-mcp did not refuse it. comfyui-mcp-secure has no parameter that takes a local path at all.

Server	Read from an arbitrary path	Write to an arbitrary path
comfyui-mcp	upload_image allows it, image extensions only	save_dir in get_image allows it
comfy-mcp	upload_file allows it, .txt passes too	out_path in fetch_template allows it
comfyui-mcp-secure	no such parameter (takes base64)	no such parameter

Those two servers read and wrote anywhere the user who launched the MCP server can. I found no setting in their READMEs that confines reads and writes to a root folder. If the model falls for a prompt injection, these path parameters can become the channel.

The same class of bug has already shipped as a real CVE. In mcp-atlassian, CVE-2026-27825 allowed arbitrary file writes because download_path was not validated. It was rated CVSS 9.0 critical and fixed in 0.17.0. A tool that accepts an output path sits in the same place as that case.

comfyui-mcp has the heaviest tool definitions at 77.3k tokens

I attached the servers one at a time and measured the MCP tools entry with claude -p "/context". The figures were 77.3k for comfyui-mcp, 25.7k for comfy-mcp and 14.5k for comfyui-mcp-secure. comfyui-mcp --compact shrank to 3 tools and 452 tokens.

Those numbers are not all loaded on every call, though. Claude Code has tool search on by default, so MCP tool definitions are deferred. The baseline with no MCP server was 15.4k. With default settings, comfyui-mcp came to 15.9k and comfyui-mcp-secure to 15.6k, barely more.

Only comfy-mcp grew by 1.6k, to 17.0k. That is because the 16,805 characters of instructions the server sends are always loaded. With ENABLE_TOOL_SEARCH=false, comfyui-mcp brings the total to 109.9k. If you run with tool search off, --compact is practically mandatory.

I also read the tool descriptions by hand to look for hidden instructions that steer the model. Every imperative phrase was guidance about the order of use. comfyui-mcp and comfy-mcp even include a sentence telling the model not to trust externally sourced content as instructions.

Install size differs tenfold: 851MB versus 82MB

I installed each server at a pinned version into an empty directory and measured the size. By du -sh, comfyui-mcp came to 192 packages and 851MB including optional dependencies. Leaving those out with --omit=optional brought it down to 109 packages and 88MB.

The largest optional dependency is @openai/codex at 323MB, followed by @anthropic-ai/claude-agent-sdk at 291MB and cloudflared at 38MB. They exist for the sidebar panel and the tunnel feature. The --omit=optional install still exposed all 41 tools. comfy-mcp came to 171MB including comfy-cli 1.23.0, and comfyui-mcp-secure to 82MB.

cloudflared downloads its binary at install time even if you never use --tunnel. npm 11.19.0 only warned that the postinstall script was not in allowScripts, and the script ran anyway. What it fetched was the unpinned latest release. I found no hash check in the code.

Every README example also uses npx -y comfyui-mcp@latest, which fetches and launches whatever is newest at that moment, each time it runs. comfy-mcp does not declare comfy-cli as a dependency, so I had to install it separately.

comfyui-mcp reached the first image fastest: 12 seconds, 4 tool calls

I asked each of the three servers for one SDXL image with the same prompt. The checkpoint was sd_xl_base_1.0.safetensors, the seed 20261028, the size 1024×1024. ComfyUI was the 0.33.1 instance on the RTX 5090 Windows machine, attached to the Mac's loopback through an SSH tunnel. The agent was claude -p running Sonnet 5.5.

Server	Result	Tool calls (incl. ToolSearch)	Wall clock	How the image was made
comfyui-mcp	success	4	12 s	one generate_image call with every value set
comfy-mcp + COMFYUI_URL	failure	9 (3 errors)	37 s	slot tools looked at the default 8188
comfy-mcp + COMFY_LOCAL_URL	success	14	89 s	fetched a template and edited 12 slots
comfyui-mcp-secure	success	3	14 s	wrote an API-format workflow directly

The images from the three servers were identical down to the pixel. In the end, each one fed the same graph to ComfyUI. The difference lay in the tool calls it took to build that graph.

Image: AI-generated (Stable Diffusion XL sd_xl_base_1.0, the output of this post's first-generation run).

In comfyui-mcp, a single generate_image takes seed, sampler and scheduler. The agent submitted, checked the status once and read the result, and that was all. comfyui_generate_image in comfyui-mcp-secure takes neither seed nor sampler, so the agent wrote the workflow itself and submitted it with comfyui_run_workflow.

The audit log of comfyui-mcp-secure recorded the list of nodes it inspected before submission, with the verdict allowed. In the default audit mode it only records risky nodes and does not block them.

comfy-mcp failed on the first attempt. When I pointed the remote-oriented COMFYUI_URL at the tunnel, list_workflow_slots returned nothing but Error executing tool. Running comfy-cli directly with the same setting gave cannot reach http://127.0.0.1:8188/object_info.

For another port on the same machine, such as an SSH tunnel, set only COMFY_LOCAL_URL. The README's Which address variable do I want? section spells out this distinction. COMFYUI_URL moves only the submission and job tools, and the remaining tools keep looking at the default 8188. After switching to COMFY_LOCAL_URL, it succeeded in 89 seconds.

The generate_image tool in comfy-mcp accepts only checkpoint and prompt. The only way to pin the seed was to edit template slots, and that back-and-forth is why the tool calls climbed to 14. ComfyUI's execution took 10.6 seconds on the first run. Later runs hit the cache because the graph was the same, so I did not compare GPU time.

The default template of generate_image also differed from the docs. The comfy-mcp 0.10.0 README says generate_image runs the SD1.5 default template. The installed package's code uses image_z_image_turbo instead, and a code comment says default was removed from the gallery.

Indeed, passing default to fetch_template produced Error executing tool fetch_template. image_z_image_turbo requires a qwen-family text encoder and the z-image model. If all you have is an SDXL checkpoint, switch the template with COMFY_T2I_TEMPLATE. You also need the environment variables that match the slot names; the code comment gives COMFY_T2I_CHECKPOINT_SLOT as an example.

An MCP server security checklist in four steps

Here is how the three servers measure up across six areas first. Each cell is a value I confirmed on 2026-10-28 by measurement or by reading the code.

Area	comfyui-mcp	comfy-mcp	comfyui-mcp-secure
Transport and auth	stdio default, HTTP token optional	stdio only	stdio default, no HTTP auth
Path scope	reads and writes arbitrary paths	reads and writes arbitrary paths	no local path parameters
Confirmation for risky actions	no server-side confirmation	user confirmation for 6 actions such as node installs	watches 159 risky nodes, warns only by default
Context	77.3k, 452 with --compact	25.7k + instructions	14.5k
Secrets and audit	returns ComfyUI launch arguments	returns launch arguments	whitelisted fields only, audit log per call
Supply chain	@latest examples, cloudflared downloaded without a hash	PyPI 47 commits behind main	unpinned uvx examples

All three had zero GitHub security advisories. No advisories does not mean no flaws, so check your own setup in the order below.

First, check whether your setup is affected

Start with which servers are attached and which transport they use. If you turned on an HTTP mode, check for open ports.

List the servers you have attached:

claude mcp list

Check the ports MCP servers have opened. If you only use stdio, no server process should show up here:

lsof -nP -iTCP -sTCP:LISTEN

Then search your config files for --http, --tunnel and transport.remote.enabled.

Pin patches and versions

Write down the version you checked instead of @latest or an unpinned uvx. Upgrade only after reading the release notes.

Register npm servers with an explicit version:

claude mcp add comfyui -- npx -y comfyui-mcp@0.52.206

Pin Python servers as well:

uv tool install "comfyui-mcp-secure==2.3.0"

If you install comfyui-mcp yourself, use --omit=optional to avoid the cloudflared download.

Narrow the settings

Turn off what you don't use to shrink the exposed surface. All of the following are settings the servers already provide.

1. If you really need an HTTP mode, set COMFYUI_MCP_HTTP_TOKEN for comfyui-mcp. The HTTP mode of comfyui-mcp-secure has no built-in auth, so you are better off using it over stdio.
2. For comfyui-mcp-secure, change security.mode in ~/.comfyui-mcp/config.yaml to enforce and list the nodes you use under allowed_nodes. According to the code, an empty list blocks nothing even in enforce. The default audit only records, and I did not run the blocking behavior.
3. If you use the panel feature of comfyui-mcp, lower COMFYUI_MCP_CODEX_SANDBOX to read-only or workspace-write. The default in the code is danger-full-access, and the README does not mention that default.
4. Run ComfyUI on 127.0.0.1 only, without --listen. Don't put secrets in ComfyUI's launch arguments: comfyui-mcp and comfy-mcp pass the launch arguments from /system_stats straight to the model.

Check for traces

Where a record of what happened ends up differs by server.

1. comfyui-mcp-secure writes one JSON line per call to ~/.comfyui-mcp/audit.log.
2. I found no built-in audit log in comfyui-mcp or comfy-mcp. Look for unfamiliar files uploaded to ComfyUI's input folder.
3. Files written through save_dir or out_path land outside the ComfyUI folder. Search your home folder for recently created images and JSON files.

Which server to pick depends on how you work

If you want an agent to drive ComfyUI deeply, comfyui-mcp does the most. In exchange, pair it with an --omit=optional install, a pinned version and stdio. If you run with tool search off, add --compact too.

If you want official support and user confirmation gates, choose comfy-mcp. When connecting through a tunnel or another port, get COMFY_LOCAL_URL right first. Before actions such as installing nodes or exposing the network, the server asks for confirmation through MCP elicitation. Note, though, that the PyPI release has been frozen since 2026-08-10, and the license is a dual choice between AGPL-3.0 and a commercial license.

If you would rather never hand local paths to MCP tools, comfyui-mcp-secure fits. It does still have tools for installing nodes and downloading models, so files on the ComfyUI side can change. It is the only one of the three with no local path parameters and an audit log. It is a small 3-star project, so keep an eye on whether maintenance continues.

Takeaways

All three servers open no port under default stdio, but comfyui-mcp and comfy-mcp read and write arbitrary local paths while comfyui-mcp-secure takes none and keeps an audit log. Pin versions, keep stdio (or set a token for HTTP), install comfyui-mcp with --omit=optional, and add --compact if you turn tool search off.

Unverified

Tunnel and external exposure modes: I did not run comfyui-mcp's --tunnel or any non-loopback bind. Exposing a server to the outside is out of scope for this post, so for those modes I only read the README and the --help text.

MCP servers launched on Windows: I ran all three servers on macOS only. Path handling and port conflicts may behave differently on Windows.

Unknown vulnerabilities in the three servers: zero GitHub security advisories only means no advisory has been published. I did not audit the full code.

Secondary MCP CVE tallies: figures such as "30 MCP CVEs in 60 days" come from secondary sources, so I left them out of the body. The cases in the body are only CVEs I checked directly in GitHub Advisory and OSV.

comfyui-mcp refusing unauthenticated non-loopback binds: --help says it refuses an unauthenticated non-loopback bind unless --allow-unauthenticated-non-loopback is given. I did not test a non-loopback bind, so I could not confirm that refusal.

The relative-path sanitizer: the comfyui-mcp tool descriptions and the comfyui-mcp-secure README say parent paths are rejected. That describes relative names inside the ComfyUI folder. I did not test parent-path strings.

Real behavior of the comfyui-mcp panel orchestrator: I confirmed the orchestrator's permission default in the code only. I did not launch the feature to see whether it actually runs with that permission.

Changelog

Version	Description
1.0	2026-10-28 first version (macOS Claude Code 2.1.312; ports, paths, context, install size and an RTX 5090 first-generation run measured for all three servers)

AI disclosure: translated and edited with AI assistance (Claude) from my Korean original. Measurements were run with Claude Code under my supervision; I reviewed the result.