Comfy Vault Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Comfy Vault Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
An MCP server that exposes comfy-vault to coding agents, so you can ask Claude or Codex to audit and clean up your ComfyUI model library in plain language.
It wraps the comfy-vault library (PyPI package comfy-model-vault, a real dependency — not vendored) as five tools. The agent calls them; comfy-vault does the work.
| Tool | What it does |
|---|---|
vault_scan | Index a models directory recursively; counts, sizes, categories. |
vault_orphans | List models no workflow references (read-only). |
vault_lora_info | Look up Civitai metadata for a file by its content hash. |
vault_duplicates | Find byte-identical duplicate models (same SHA256). |
vault_delete | Delete orphans — dry-run unless `confirm=true`, fenced to the scanned roots. |
pip install comfy-vault-mcpThis installs comfy-model-vault (the comfy-vault library) as a dependency. Python 3.10+.
claude mcp add comfy-vault -- comfy-vault-mcpor add it to .mcp.json in your project:
{
"mcpServers": {
"comfy-vault": {
"command": "comfy-vault-mcp"
}
}
}Add to ~/.codex/config.toml:
[mcp_servers.comfy-vault]
command = "comfy-vault-mcp"Once connected, ask in natural language:
"Find all unused Pony LoRAs over 2 GB in D:\ComfyUI\models, check which of them still exist on Civitai, and show me the duplicates — but don't delete anything yet."The agent will call vault_orphans, vault_lora_info, and vault_duplicates, then summarise. vault_delete stays a dry-run until you explicitly confirm.
Set COMFY_VAULT_CIVITAI_FIXTURES to a directory of recorded {sha256}.json Civitai responses, and vault_lora_info resolves from those instead of the live API — no network, no key. This is how the test suite runs. For live use, an optional CIVITAI_API_KEY raises your rate limit but is not required.
MIT. Same license as comfy-vault, for consistency across the toolkit.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.