Skip to main content
When connect drives a remote HTTPS pod, comfyui-mcp needs a valid-TLS wss:// path from the pod’s browser panel back to the agent bridge on your machine (a plain ws:// from an https:// page is browser-blocked). By default this is a cloudflared quick tunnel — zero setup, but ephemeral (a fresh random hostname every run). For organizations that need to own that path end-to-end — the control channel never transits a third party, a fixed domain for firewall/audit rules, or no dependency on a service outside your infrastructure — comfyui-mcp supports routing the secure bridge through a relay you operate, in place of the default quick tunnel.
The reference implementation is open source: artokun/comfyui-mcp-relay — a Cloudflare Worker + Durable Object, MIT licensed, marked as a GitHub template so you can click Use this template and have your own copy in seconds. Fork it, deploy it as-is, or adapt it to whatever WebSocket-capable infrastructure your organization already runs — the README documents the wire protocol, session lifecycle, and design tradeoffs (multiplexing, auth, hibernation) in full.

​
Why self-host

  • Data residency / compliance — the bridge carries tool calls and graph operations (not image bytes, which flow pod↔browser directly), but some organizations still need that control channel to stay inside infrastructure they operate.
  • No third-party runtime dependency — a fixed, owned endpoint instead of relying on an external relay’s availability.
  • Firewall / audit rules — a stable domain you control is easier to allow-list and log than an ephemeral hostname that changes every session.

​
How it fits together

Both sides of the bridge dial out — nobody needs an inbound port open anywhere. Your relay’s job is to pair one orchestrator (running on a user’s machine) with the browser panel connections on the pod it’s driving, and shuttle bytes between them; it never needs to understand comfyui-mcp’s own tool-call protocol riding on top. Once a relay is deployed, pointing comfyui-mcp at it is a couple of environment variables:
With COMFYUI_MCP_TUNNEL_BACKEND unset, comfyui-mcp keeps using the default ephemeral quick-tunnel behavior — this is entirely opt-in.

​
Deploy the reference implementation

See artokun/comfyui-mcp-relay for the full README — the wire protocol, auth model, and deploy steps.