ComfyUI Has an Official MCP Server Now — And 1,000 Hijacked Instances

ComfyUI's official MCP server lets an AI agent run your whole image pipeline. But its registry shipped a password stealer and 1,000+ self-hosted instances became a cryptomining botnet. Here's the setup that gets one without the other.

Short answer: yes, adopt ComfyUI — but on an isolated machine, with the plugin store treated as hostile. In August 2026 Comfy Org shipped an official MCP server, which means an AI agent can now drive a full image and video production pipeline end to end. In the same window, its official plugin registry shipped an information stealer, and researchers found over 1,000 self-hosted instances hijacked into a cryptomining botnet. Both facts are true. The setup below gets you the first without the second.

What is ComfyUI, and why does the MCP part matter?

ComfyUI is a node-based engine for generating images, video, audio and 3D. You do not press a button — you wire a graph. The core is GPL-3.0 and runs on your own hardware, which makes it structurally different from the AI tools most agencies rent: if the vendor disappears, your installation keeps running.

The repository at Comfy-Org/ComfyUI carries 130,287 stars and 15,356 forks, with 328 pages of contributors in the GitHub API. It shipped five releases in twenty-four days in August 2026, ending at v0.34.0 on 26 August. The older comfyanonymous/ComfyUI URL now 301-redirects here — same project, new home.

The thing that changed in 2026 is not the engine. It is the plumbing around it:

That last row is the quiet masterstroke. The proxy README calls it "one contract, three surfaces": identical client code drives Comfy Cloud, a serverless deployment, or the box under your desk — you change one environment variable. For anyone building a production pipeline, that removes the usual migration tax between "prototype in the cloud" and "run it in-house".

What does the official MCP server actually do?

comfy-mcp is a stdio server your AI client launches as a subprocess. It shells out to comfy-cli and drives the ComfyUI at 127.0.0.1:8188. Its README lists the capability groups:

• Generate — run a workflow JSON, or go text prompt → image in one call
• Monitor jobs — submit async, then wait, watch, cancel, read the failure verdict, collect outputs
• Introspect the live install — search the nodes, models and templates your ComfyUI actually has, not a static catalogue
• Build workflows — validate a graph, edit a template's slots, and fan one workflow into variants
• Manage the server — launch, stop, restart, tail logs, stage input assets

Read that fan-out capability again. Twenty ad-creative variants of one concept, generated from one agent instruction, is a production economics change — not a demo. The README is honest about maturity: "Status: beta. 40 tools; core loop validated end-to-end against a live local ComfyUI."

What does it cost?

The engine costs nothing. Comfy Cloud sells GPU convenience on top:

Hardware is a Blackwell RTX 6000 Pro with 96GB VRAM, and one credit is roughly one second of active GPU runtime — editing a workflow costs nothing, only execution burns. That billing model is more honest than the per-generation credit systems most wrappers use.

One caveat the pricing page will not tell you: failed generations still consume credits, because the GPU still ran. Your real number is cost per usable asset, not per generation, and you can only get it by measuring your own output.

The part nobody puts in the launch post

Now the other half, which is why this is a conditional recommendation rather than a clean yes.

The official registry has shipped malware — more than once. Issue #11791 on the ComfyUI repository, opened 10 January 2026 and still open, documents ComfyUI-Upscaler-4K distributing Akira Stealer, a modular Go infostealer, through the official Comfy Registry. The detail that should worry you is in the thread: a user reports the original package was removed, "but there is already a new 'upscaler-4k'... it is even from the same creator." Takedown did not stop re-upload.

That was not the first. ComfyUI_LLMVISION posed as a helpful extension while stealing browser passwords, credit card details and browsing history, exfiltrating to an attacker-controlled Discord server.

And exposed instances get taken over at scale. A Cloud Security Alliance research note dated 8 April 2026 found over 1,000 publicly accessible ComfyUI instances with no authentication across major cloud providers. Attackers chained vulnerable custom nodes with CVE-2025-67303 — an unprotected alternate channel in ComfyUI-Manager before v3.38 — and installed XMRig for Monero, lolMiner for Conflux, and a Hysteria V2 proxy botnet. The remediation list: update Manager to 3.38+ and core to v0.3.76+, take public instances offline, remove nodes exposing shell execution, and put the whole thing behind authenticated network controls.

There is a stability tax too. The repository carries 4,149 open issues. Independent write-ups document frontend 1.39.0 in January 2026 being described as "everything is broken" — crashing in Chrome even with custom nodes disabled — plus workflow drafts failing to persist and core updates breaking nodes in popular packs. Five releases in twenty-four days cuts both ways.

Does the licence protect your clients' material?

This is where ComfyUI scores better than most, and it is worth quoting rather than paraphrasing. The Comfy Terms of Service state that "Customer retains all right, title, and interest in and to any data, images, videos, prompts, models, workflows, nodes, parameters, or other materials" submitted, as well as the outputs generated from them. And explicitly: "Comfy will not use Input or Output to train generative AI or diffusion models." They reserve only limited metadata — prompt classifications, workflow structures, node configurations.

Two cautions. First, liability is capped at the greater of $1,000 or six months of fees — with a $20 plan, that ceiling is effectively $1,000, which does not cover a client data incident. Second, the Privacy Policy addresses personal information (name, email) but says nothing about how long generated content is retained, offering only "as long as we need to". For client faces, unreleased menus and anything under NDA, self-hosting removes both problems: the files never leave your machine.

The setup that gets the upside without the incident

1. Dedicated machine or VM. The box running ComfyUI must not be the box holding your CRM, your database credentials, or your clients' ad accounts. One malicious node is a client data breach, not a bad afternoon.
2. Core nodes only. Do not install a custom node because a tutorial recommended it. The official registry has already failed this test twice.
3. Never expose it to the internet. No port forwarding, no public IP. That single mistake is what produced the thousand-instance botnet.
4. Patch first, generate second. ComfyUI-Manager 3.38+, core v0.3.76+, before anything else.
5. Pin your version during a campaign. Lock the release tag that works and do not auto-update mid-delivery. Five releases in twenty-four days will break your graph at the worst possible moment.
6. Start on Cloud at $20, then move in-house. Measure your usable-asset rate for a month. If it clears your bar, move to self-host plus comfy-api-proxy and the SDK. Thanks to "one contract, three surfaces", none of the first month's integration work is thrown away.

Should you recommend it to your clients?

No — and the security record is the reason, not just the learning curve.

Technically a business owner can run the free build or pay $20. Practically, this is a node graph engine with 4,149 open issues and a community that regularly loses a day to a broken update. It is not Canva. More importantly: if you point a non-technical client at a tool whose plugin store has shipped a password stealer, and they follow a YouTube tutorial into installing one, you helped cause that. The honest framing is that ComfyUI produces images, not marketing — it does not shoot at the location, plan the campaign, buy the media, answer the inbox, or report the numbers. Keep it backstage, where someone qualified is watching it.

FAQ

Is ComfyUI free? The engine is, under GPL-3.0, running on your own hardware. Comfy Cloud starts at $20/month for 4,200 credits, with a free tier of 5 GPU runs. "Free" removes the invoice, not the hardware, the operator time, or the security responsibility.

Does ComfyUI have an official MCP server? Yes — two. comfy-mcp runs locally over stdio and drives your own install (40 tools, beta), and a hosted HTTP server at cloud.comfy.org/mcp executes on Comfy Cloud GPUs. A Claude Code plugin, comfy-skills, is MIT-licensed and installs both the connection and the slash commands.

Is ComfyUI safe to use? The core is; the plugin ecosystem is not automatically. The official registry has distributed Akira Stealer and, earlier, ComfyUI_LLMVISION, which stole browser passwords and card details. Over 1,000 exposed instances were hijacked for cryptomining via CVE-2025-67303. Run it isolated, patched, offline from the public internet, and with core nodes only.

Does Comfy train AI models on my images? No. The Terms of Service state Comfy "will not use Input or Output to train generative AI or diffusion models", and you retain ownership of both. They keep limited metadata such as workflow structures. Liability, however, is capped at $1,000 or six months of fees.

Can I use the same code for cloud and self-hosted? Yes. The MIT-licensed Python and TypeScript SDKs speak Comfy API v2 against Comfy Cloud, serverless, or a self-hosted instance — you change COMFY_BASE_URL. The comfy-api-proxy package puts that same API in front of your own install.

References

• Comfy-Org/ComfyUI on GitHub — stars, forks, releases, licence
• Issue #11791 — Akira Stealer in the Comfy Registry
• Comfy Cloud pricing · Terms of Service · Privacy Policy
• comfy-mcp · comfy-skills · comfy-api-proxy · comfy-python-sdk
• Cloud Security Alliance — AI Workload Exposure & Cryptomining (8 Apr 2026)
• Hackread — malicious ComfyUI node steals crypto and browser data · Snyk Labs — hacking ComfyUI through custom nodes
• Why ComfyUI updates break workflows

#ComfyUI #MCP #AIAgents #AISecurity #SupplyChainSecurity #StableDiffusion #SelfHosting #OpenSource #AITools #DevSecOps

✍️ The Author: Do Ngoc Hoan Founder of CookConnects.ca & Wizy.ca. Bridging the gap between advanced algorithms and business execution. I write for technical founders looking to scale their impact with AI and robust engineering.

← Blog