Stability Matrix: One-Click Installer for Stable Diffusion UIs (GitHub, Scanned)

Stability Matrix is a package manager for AI image tools. Instead of cloning repositories and fighting Python versions, you pick ComfyUI, Stable Diffusion WebUI Forge or reForge, Automatic1111, SD.Next, Fooocus, InvokeAI, SwarmUI, or trainers such as Kohya's GUI, OneTrainer and FluxGym, and it installs each one with its own embedded Python and Git, then updates and launches them from one window. Extensions for ComfyUI, Automatic1111 and SD.Next can be managed from the same place.

The part that saves the most disk space is the shared model library: checkpoints, LoRAs and other models live in one folder that every installed interface reads, so you never keep three copies of the same 6 GB file. A built-in browser imports models from CivitAI and Hugging Face with their metadata and preview images, and pauses and resumes downloads. It also has its own generation interface, Inference, built on ComfyUI, with tabbed projects and prompt autocompletion.

Stability Matrix is made by Lykos AI and has about 8,900 stars. The source code is AGPL-3.0, while the prebuilt binaries are distributed under Lykos AI's own end-user licence agreement. The latest release, 2.16.4, came out in September 2026.

• Repository: github.com/LykosAI/StabilityMatrix
• Licence: AGPL-3.0 (GNU Affero General Public License v3.0)
• Language: C#. Stars: 8,865. Forks: 606. Last push: Oct 1, 2026.
• Scan: safe, Oct 1, 2026, commit 604387e

Who it is for

People who want to try several Stable Diffusion and Flux interfaces without learning Python environment management, and anyone whose model folder has grown large enough to hurt.

Getting started

1. Windows: download the latest build, unzip it and run StabilityMatrix.exe

start https://github.com/LykosAI/StabilityMatrix/releases/latest/download/StabilityMatrix-win-x64.zip

2. macOS (Apple Silicon): download the disk image

open https://github.com/LykosAI/StabilityMatrix/releases/latest/download/StabilityMatrix-macos-arm64.dmg

3. Linux: the AppImage zip, or the stabilitymatrix package on the AUR

curl -LO https://github.com/LykosAI/StabilityMatrix/releases/latest/download/StabilityMatrix-linux-x64.zip

4. Pick a data folder, then add a package such as ComfyUI or Forge from the Packages tab

# Packages > Add Package > ComfyUI > Install

Stability Matrix is portable: its data folder holds every package and model, and can be moved to another drive or computer. It sends crash reports and performance traces to Sentry unless you launch it with --no-sentry. The interfaces it installs set their own hardware needs, usually a reasonably recent GPU; NVIDIA cards are the best supported.

Safety scan

We cloned LykosAI/StabilityMatrix at commit 604387e on Oct 1, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.

• No secrets, no pattern hits, no bare-IP URLs and no install hooks across 1,843 files and about 205,000 lines, 193,000 of them C#.
• 34 committed binaries: an embeddable Python 3.10 for Windows (python.exe, the core DLLs including OpenSSL 1.1, which is past end of life, and extension modules) in the original WPF project's StabilityMatrix/Assets folder, and 7-Zip executables for Windows, macOS and Linux used to unpack downloads. The names match upstream builds, but a scan cannot confirm the bytes do.
• StabilityMatrix.Avalonia/Program.cs initializes Sentry with session tracking and a 100 percent trace sample rate unless you launch with --no-sentry or a debugger is attached. The DSN in the code is a public client key, not a secret. Other traffic is what the app is for: CivitAI and Hugging Face for models, GitHub and PyTorch for packages, and Lykos AI's CDN.
• 8 known advisories, none critical (4 high), all in docs/package-lock.json, the documentation site's build tooling (vite, postcss, nanoid, esbuild). The C# app's NuGet packages are not in a lockfile the scanner reads, so they were not checked.
• 8 workflows. cla.yml uses pull_request_target to run the contributor-assistant CLA action (tag v2.3.0) without checking out pull request code; none of the 12 third-party actions is pinned to a commit. Dependabot, licence and contributing guide present; no security policy or CodeQL. Release binaries are under Lykos AI's own licence agreement, not the AGPL.

What the scanner counted

The raw findings

Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.

By the numbers

Lines by language: C# 192.7K, Markdown 6,204, JSON 2,517, CSS 1,131, YAML 1,119, Python 653.

Questions

Is Stability Matrix free?

Yes, it costs nothing to download and use. The source code is AGPL-3.0; the ready-made builds are released under Lykos AI's end-user licence agreement. The interfaces it installs are free open-source projects, and models from CivitAI and Hugging Face carry their own licences.

Which interfaces can Stability Matrix install?

ComfyUI, Stable Diffusion WebUI Forge, reForge and AMDGPU Forge, Automatic1111 and its DirectML fork, SD Web UI-UX, SD.Next, Fooocus and several Fooocus forks, SimpleSDXL, SwarmUI, VoltaML, InvokeAI, SDFX, Kohya's GUI, OneTrainer, FluxGym and CogVideo through CogStudio.

Can Stability Matrix use models I already have?

Yes. Drag existing model files into its Checkpoint Manager, or point it at your current folders, and it can look up CivitAI metadata and preview thumbnails for them. Every interface it installs is then wired to that one shared library.

This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.