comfyui-mcp

What the source does

• FilesystemNone observedNo reads or writes in the source
• NetworkDeclared11 observations
• ShellDeclared5 observations
• DependenciesNot pinnedSome versions float
• SecretsFoundSee the findings; values are never shown

Five audit layers

Gates applied: no behavioural pass.

`Install cloudflared (npm i -g cloudflared), or re-run with --insecure-bridge and open the pod through an ` +

`Install cloudflared (npm i -g cloudflared), or re-run with --insecure-bridge and open the pod through an ` +

- **RunPod UI won't load / asks for a password.** Confirm `AI_TOOLKIT_AUTH` is set and you're on the 8675 proxy URL.

description: "سطح کنترلِ محلیمحور و بومیِ عامل برای ComfyUI — یک سرور MCP بههمراه افزونهٔ Claude Code که با زبان طبیعی تصویر، ویدیو و صدا تولید میکند، گردشکار مینویسد و اجرا میکند، و مدلها و گرههای سف

**ComfyUI MCP** همان **سطح کنترلِ محلیمحور و بومیِ عامل** برای

در حال اجرای ComfyUI وصل میکند — **محلی**، **از راه دور**، یا

**[Comfy Cloud](https://cloud.comfy.org)** — تا بتوانید تصویر، ویدیو و صدا تولید کنید، گردشکارها را

اجرا و تألیف کنید، مدلها و گرههای سفارشی را مدیریت کنید و سرور را کنترل کنید؛ همهٔ اینها با زبان

logger.warn(`[grok-backend] direct-token turn failed: ${msgOf(err)}`);

logger.info(`[panel-orchestrator] secret set from panel Settings: ${key} (redacted)`);

logger.info(`[ui-bridge] pairing listener on ws://${host}:${port} (token-gated)`);

"/9j/4AAQSkZJRgABAQAAAQABAAD/2wBDAAgGBgcGBQgHBwcJCQgKDBQNDAsLDBkSEw8UHRofHh0aHBwgJC4nICIsIxwcKDcpLDAxNDQ0Hyc5PTgyPC4zNDL/2wBDAQkJCQwLDBgNDRgyIRwhMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjI

const normalized = content.replace(/^/, '').replace(/\r\n/g, '\n');

{ filename: "…", status: "…", trayId: "a" },

const TOKEN = "…";

const { TOKEN } = vi.hoisted(() => ({ TOKEN: "…" }));

const token = "…";

const token = "…";

const token = "…";

"…";

ollama-image-payload-budget.test.ts

remote-payload-probe.test.ts

for (const body of scripts) expect(() => new Function(body)).not.toThrow();

for (const body of scripts) expect(() => new Function(body)).not.toThrow();

return new Function(

Audit 0.4.1 · source sha a1f0ff69c3a7 · 25 Oct 2026Report an issue or request a re-scan

• Publisherartokun GitHub userOwner of the repository this skill is read from
• Source folderartokun/comfyui-mcpThe exact folder we audited
• LicenceMITAs the repository states it
• Commit pinned for this verdicta1f0ff69c3a7A new audit runs when the source changes
• Repository statusNot archivedPushed today
• Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

Its description: Train custom LoRAs with ostris AI-Toolkit. Covers WAN 2.2/2.1 (people, styles, video motion) and Z-Image (Turbo & Base, low-VRAM image LoRAs). Use when the user wants to train a WAN or Z-Image LoRA; covers local +…

---
name: ai-toolkit-trainer
description: Train custom LoRAs with ostris AI-Toolkit. Covers WAN 2.2/2.1 (people, styles, video motion) and Z-Image (Turbo & Base, low-VRAM image LoRAs). Use when the user wants to train a WAN or Z-Image LoRA; covers local + RunPod setup, dataset prep, key params, and using the result in a ComfyUI workflow.
globs:
  - "**/*.json"
---

# AI-Toolkit LoRA Trainer (WAN 2.2 & Z-Image)

## Overview

AI-Toolkit by ostris is an MIT-licensed trainer for finetuning diffusion models. It is a standalone trainer with its own web UI, not a ComfyUI custom node. It runs a Node.js UI front end over a Python (`run.py`) training backend and trains LoRAs for many model families. This skill covers the WAN 2.2 / 2.1 video models and Z-Image (Turbo & Base).

- Repo: `https://github.com/ostris/ai-toolkit` (cloned by the installers).
- Backend: `python run.py config/<job>.yml`. UI: a Node.js app under `ui/` that schedules and monitors jobs. You do not have to keep the UI open while a job runs.
- Output: a standard `.safetensors` LoRA you drop into ComfyUI `models/loras/` and load with `LoraLoaderModelOnly`.

Best for:
- WAN LoRAs. A person or character, an art style, or a specific camera or video motion, trained from image or video clip datasets. For *using* WAN see wan-t2v-video / wan-flf-video.
- Z-Image LoRAs. Fast, very low-VRAM image LoRAs (faces, characters, outfits, styles) on the 6B Z-Image base/turbo. For *using* Z-Image see z-image-base / z-image-turbo, and the z-image-xy-plot pack to compare trained LoRAs.

For low-VRAM anime image LoRAs on a different stack (kohya `sd-scripts`), see the sibling anima-lora-trainer.

> Two LoRA kinds for WAN. A WAN image LoRA trains on still images; it is cheaper (~24GB-class) and suits identity or style. A WAN video LoRA trains on short clips; it is heavier, best run on cloud, and suits *motion*. Z-Image is image-only.

## Install

The installer comes in two generations. Both clone `ostris/ai-toolkit`, set up Torch for your GPU, and launch the web UI. Put it in a folder whose full path has no spaces (e.g. `C:\AI-Toolkit`).

- V1, `AI-TOOLKIT_AUTO_INSTALL.bat`, expects Git, Python 3.10.x, and Node 18+ already in PATH.
- V2, `AI-TOOLKIT_AUTO_INSTALL-V2.bat` (recommended), uses an embedded Python 3.10.11, auto-installs Git and Node, builds a clean PATH without your system Python, and adds aggressive pip/curl retries. It has far fewer prerequisites and fails less often. The Z-Image Turbo LoRA training release used it.

Both are CUDA-aware and select the Torch wheel by GPU generation:

| Choice | GPU | CUDA | Torch index | Torch packages |
|--------|-----|------|-------------|----------------|
| 1 | RTX 50-series (Blackwell) | **12.8** | `https://download.pytorch.org/whl/cu128` | `torch==2.7.0 torchvision==0.22.0` |
| 2 | RTX 40 / 30 / 20 and older | **12.6** | `https://download.pytorch.org/whl/cu126` | `torch==2.7.0 torchvision==0.22.0` |

Each then clones `ostris/ai-toolkit`, downloads two launcher scripts (`LAUNCHER-TOOLKIT.bat`, `SECURE_LAUNCHER-TOOLKIT.bat`, from `https://huggingface.co/Aitrepreneur/FLX/resolve/main/`), makes the venv, installs Torch from the chosen index, runs `pip install -r requirements.txt`, then `cd ui && npm run build_and_start`.

### RunPod / Linux — `AI-TOOLKIT_AUTO_INSTALL-RUNPOD.sh` (and `-V2.sh`)

Installs into the persistent volume `/workspace/ai-toolkit`. It is idempotent; a re-run just relaunches the UI. Use RunPod's PyTorch 2.8.0 template and a 100GB disk. It installs apt deps, clones the repo, makes a venv, installs Torch (`torchaudio` included), installs nvm + Node 22, then builds and starts the UI.

| Choice | GPU | Stream | Torch spec |
|--------|-----|--------|-----------|
| 1 | RTX 5000-series (Blackwell) | `cu128` | `torch==2.7.0+cu128 torchvision==0.22.0+cu128 torchaudio==2.7.0+cu128` |
| 2 | Ada / Hopper / Ampere, older | `cu126` | `torch==2.7.0 torchvision==0.22.0 torchaudio==2.7.0` |

The UI listens on 8675 and Jupyter on 8888. Set `AI_TOOLKIT_AUTH` (UI password) before launch. Reach it at `https://${RUNPOD_POD_ID}-8675.proxy.runpod.net`. Use an RTX 4090/5090 for image (WAN t2i/t2v, Z-Image) LoRAs and an RTX 6000 Pro (Blackwell) for heavy WAN video, high-res, or high-rank jobs.

## Launching the web UI

- On Windows, run `LAUNCHER-TOOLKIT.bat` (local) or `SECURE_LAUNCHER-TOOLKIT.bat` (password-protected) from the `ai-toolkit` folder.
- On RunPod, rerun the `.sh`. It detects the install and starts the UI on :8675.

In the UI, create a Job, point it at a dataset folder, pick the model (WAN variant or Z-Image), set params, and start. Jobs run in the Python backend, so you can close the browser. To bypass the UI, copy a `config/examples/*.yml`, edit it, and run `python run.py config/<job>.yml`.

## Dataset preparation

AI-Toolkit pairs each sample with a same-basename `.txt` caption and auto-resizes/buckets aspect ratios (no pre-cropping).

### Image LoRA (WAN identity/style, or Z-Image)
```
my_dataset/
  001.png  001.txt
  002.jpg  002.txt
```
- Captions are natural language. Include a unique trigger word for a person or character.
- Use about 15 to 40 varied images for a person, more for a broad style.

### Video LoRA (WAN motion only)
Short clips plus a `.txt` per clip; caption the motion or camera move. Set per-clip frames via the job's `num_frames` (e.g. 81). This is markedly heavier, so prefer cloud GPUs.

## Key training params

### WAN 2.2
WAN 2.2 14B is a Mixture-of-Experts with a high-noise expert (structure/motion) and a low-noise expert (detail). AI-Toolkit trains both via Multi-stage.

| Param | Default | Notes |
|-------|---------|-------|
| Linear rank / dim | **16** | 16 simple; 16–32 complex/cinematic |
| Learning rate | **5e-5** (identity) | 7e-5–1e-4 style; high LR → plasticky skin |
| Steps | **1500–2500** | stop before overbaking |
| Resolution | **512** (or 768) | bucketed; 768 costs more VRAM |
| `num_frames` (video) | **81** | per-clip frame count |
| Multi-stage | **High + L

Excerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

1. 2026-10-25
   ✕BLOCK F 26 / 100

   first audit · source a1f0ff69c3a7

Questions about comfyui-mcp

• github.com/artokun/comfyui-mcp — the audited source at commit a1f0ff69c3a7 and every finding aboveObserved · 25 Oct 2026

Spotted something wrong? Report a correction · Methodology