A node graph makes the generation recipe visible
ComfyUI turns a generative pipeline into boxes and wires. A graph can load a checkpoint, encode a prompt, apply ControlNet or LoRA inputs, sample, upscale, and save the result while preserving every setting. Workflows can be stored as JSON or recovered from supported generated media. That helps when an image must be reproduced or handed to another operator, because the recipe is inspectable instead of living in screenshots and remembered settings.
The scope now stretches beyond Stable Diffusion. The README lists image editing, video, audio, 3D, vision, and text model families, while App Mode can hide a finished graph behind a smaller interface. A local API queues those workflows. This breadth is the main reason to choose ComfyUI, but model files, node versions, memory use, and backend compatibility become part of the system you maintain.
The 5,903 MB environment is only the starting cost
Our fresh Debian checkout contained 1,062 files, about 285,875 lines of source, and 45.1 MB before installation. Installing commit 82f839f took 131 seconds, pulled 124 packages, and left 5,903 MB on disk. The repository had 28 CI workflow files and a tests directory, though it had no Dockerfile. Pip-audit found 0 known vulnerabilities in the installed Python packages.
Model weights are separate from that 5,903 MB result. Users place checkpoints, VAEs, text encoders, LoRAs, and other files into named model directories, or point ComfyUI at shared locations through extra_model_paths.yaml. The core stays offline unless requested, and --disable-api-nodes turns off optional paid API nodes. Partner nodes call outside services, changing the privacy and credential picture.
What happened when we ran it
Our sandbox install succeeded in 131 seconds and the build completed in 21 seconds. The test command ran for 441 seconds before exiting with failure. Pytest reported 1,397 passed, 44 failed, 10 skipped, plus 65 collection or setup errors out of 1,506. A passing build did not mean the checked-out commit was clean in the same environment.
The log tail named security tests for preview path traversal, null bytes in filenames, user-data content types, and inline SVG response caching. Those lines were errors, not assertion messages that establish a product vulnerability. The log does not show their cause, so we cannot say whether code, fixtures, services, or the fresh container caused them. The 3-CPU, 8 GB Python 3.12 run did not complete its full suite successfully.
Hardware support comes with backend-specific choices
Manual installation branches by accelerator. The README gives separate PyTorch routes for NVIDIA CUDA, AMD ROCm, Intel XPU, Apple Silicon, Huawei Ascend, and CPU use. The Windows portable builds split NVIDIA, AMD, and Intel hardware, and the current general NVIDIA package uses Python 3.13 with CUDA 13.0. This coverage makes a generic installation guide impossible for a mixed fleet.
An open August 27 issue describes Z-Image Turbo producing non-finite output on the first warm rerun on an AMD RX 9070 XT with ROCm 7.14. The reporter reproduced it twice across independent clones and did not reproduce the same graph on CUDA. Another report shows MiniMax H3 video encoding exhausting a 16 GB GPU while trying to allocate 7.17 GiB. These specific reports show why teams should qualify exact models on exact drivers.
Custom nodes carry the same trust as Python packages
ComfyUI binds to 127.0.0.1 by default. Its security policy assumes that anyone who can reach the URL is trusted, and it assigns firewall, reverse-proxy, and authentication duties to users who enable network exposure. A studio server needs an access layer, especially when workflows or model directories contain private material.
The same policy says custom nodes are arbitrary Python code. Installing one gives it the trust of other software on the machine, so a popular workflow can carry a dependency that the core maintainers do not audit. Pin node revisions, record their sources, and test upgrades away from production. The README warns that master commits outside stable tags may break many custom nodes, a direct reason to follow releases instead of updating every checkout automatically.
App Mode helps operators, while graph authors still need the graph
The canvas has shortcuts for queuing, bypassing, muting, grouping, and reconnecting nodes. Partial graph re-execution avoids repeating unchanged work, and memory management can offload models between RAM and VRAM. Those controls suit a technical artist debugging a pipeline. They are a poor first interface for a colleague who only needs to change a prompt, upload an image, and collect an output.
App Mode exposes selected inputs and outputs after a workflow is stable. The API plays a similar role for software integration. Neither removes the authoring cost. Someone still owns model placement, version compatibility, error handling, and the graph. If nobody wants that job, a narrower UI is likely to produce fewer support requests.
August 2026 activity is high, and the queue is large
GitHub showed 130,176 stars, 4,721 open issues and pull requests, and a last push on August 27, 2026. The combined count includes pull requests, so it is not a defect total. Release v0.34.0 arrived on August 26 with model additions, frontend and template updates, HDR video saving work, and fixes. Activity at this scale also means frequent compatibility movement.
ComfyUI earns its place when a node graph is the asset your team wants to preserve. Our 1,397 passing tests show a substantial exercised codebase, while the 44 failures and 65 setup or collection errors block an unqualified reliability claim for commit 82f839f. Adopt a stable tag, qualify the hardware and models, treat every custom node as code, and authenticate any remote instance.