ComfyUI-Manager: Install and Update ComfyUI Custom Nodes (GitHub, Scanned)

ComfyUI-Manager is the extension most ComfyUI users install first. It adds a Manager button to ComfyUI that lists thousands of community custom nodes and models, installs them with their Python dependencies, updates or disables them, and can find and install the missing nodes when you open a workflow someone else made. It also takes snapshots of your setup so you can roll back after an update breaks something.

It is now maintained under Comfy-Org, the company behind ComfyUI, and it is backed by the official node registry at registry.comfy.org. That matters because custom nodes are ordinary Python code that runs with full access to your machine, and the Manager is where you decide which of them to trust. It has a security_level setting and separate switches for installing from arbitrary Git URLs or pip, and a recent release moved its data into a protected folder after a security fix.

The main limit is the ecosystem rather than the Manager itself: a node in the list is not a node anyone has audited. Stick to well-known nodes, keep the default security level, and be careful with the Try Install option for nodes whose details could not be confirmed.

• Repository: github.com/Comfy-Org/ComfyUI-Manager
• Licence: GPL-3.0 (GNU General Public License v3.0)
• Language: Python. Stars: 16.6K. Forks: 2,563. Last push: Oct 24, 2026.
• Scan: safe, Oct 26, 2026, commit 7e1af9c

Who it is for

Anyone running ComfyUI for image, video or audio generation who installs community custom nodes, which in practice is almost every ComfyUI user.

Getting started

1. From your ComfyUI folder, go to the custom nodes directory

cd ComfyUI/custom_nodes

2. Clone the Manager into a folder named comfyui-manager, then restart ComfyUI

git clone https://github.com/ltdrdata/ComfyUI-Manager comfyui-manager

3. Or install ComfyUI and the Manager together with comfy-cli

pip install comfy-cli && comfy install

The ltdrdata URL in the README redirects to the Comfy-Org repository. For the Windows portable build, the README provides install-manager-for-portable-version.bat to save into the portable folder and run.

Safety scan

We cloned Comfy-Org/ComfyUI-Manager at commit 7e1af9c on Oct 26, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.

• No secrets, no suspicious code patterns, no install hooks and no binaries across 128 files. About 91,000 of the 128,000 lines are JSON: the catalogue of custom nodes and models the Manager offers.
• The one installer, scripts/install-comfyui-venv-linux.sh (22 lines), clones ComfyUI and the Manager, makes a virtual environment and installs PyTorch from download.pytorch.org. No sudo and nothing piped into a shell.
• Installing a custom node runs git clone and pip install for code written by someone else. The security_level setting (strong, normal, normal- or weak) and the allow_git_url_install and allow_pip_install switches in config.ini control how much the UI is allowed to do, and the defaults block the riskiest options. If you expose ComfyUI to your network with --listen, keep them that way.
• The share feature can upload workflows and images to comfyworkflows.com, OpenArt or YouML, but only when you click Share. The other hosts in the code are the node and model sources listed in the catalogue, mostly GitHub and Hugging Face.
• No lockfiles, so no dependency advisories. Three workflows with three third-party actions pinned to tags, none using pull_request_target. Licence present; no security policy file.

What the scanner counted

The raw findings

Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.

By the numbers

Lines by language: JSON 90.9K, Python 19.5K, JavaScript 12.5K, CSS 1,815, Markdown 1,386, YAML 1,194.

Questions

Is ComfyUI-Manager free?

Yes. It is GPL-3.0-licensed and free, like ComfyUI itself. Custom nodes and models you install through it carry their own licences.

Are custom nodes from the Manager safe?

Not automatically. A custom node is Python code that runs with full access to your computer, and being listed in the Manager does not mean anyone reviewed it. Prefer popular, actively maintained nodes, keep the security level at its default, and avoid installing from unknown Git URLs.

Can it install the nodes a downloaded workflow needs?

Yes. Open the workflow, then use the Manager's option to install missing custom nodes; it matches the node types in the workflow against its catalogue and installs the packs that provide them.

This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.