Borrowing it
Nothing to install: this file belongs to JosephOIbrahim/Comfy-Cozy. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/JosephOIbrahim/Comfy-Cozy/master/.claude/commands/PRODUCTION_HARDEN.mdgit clone --depth 1 https://github.com/JosephOIbrahim/Comfy-CozyWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/josephoibrahim/comfy-cozy/production_harden)<a href="https://agentmods.dev/commands/josephoibrahim/comfy-cozy/production_harden"><img src="https://agentmods.dev/badge/commands/josephoibrahim/comfy-cozy/production_harden/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/commands/josephoibrahim/comfy-cozy/production_harden"><img src="https://agentmods.dev/badge/commands/josephoibrahim/comfy-cozy/production_harden.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.03513 |
| Opus 5 | $0.00000 | $0.01757 |
| Sonnet 5 | $0.00000 | $0.00703 |
| Haiku 4.5 | $0.00000 | $0.00351 |
Grade A, and why
PRODUCTION_HARDEN scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 280 lines — stays where its author put it; the contents beside it link to each section on GitHub.
PRODUCTION HARDENING — MoE Agent Team Orchestration
Mission: Autonomously production-harden ComfyUI-Comfy Cozy Agent using specialized agent teams routed by Mixture-of-Experts domain decomposition.
Runtime: Claude Code with Sonnet 4.6 sub-agents Target: VFX workstation — Threadripper PRO 7965WX, RTX 4090, 128GB DDR5, Windows Baseline: 497 tests passing, 0 lint errors, 10,678 LOC agent / 6,863 LOC tests
MoE TEAM ROSTER
Each agent is a Claude Code sub-agent invoked via claude --model claude-sonnet-4-6-20250929
with a role-specific prompt file. Agents operate on branches, submit PRs via conventional commits.
| Agent | Role | Domain | Branch Prefix |
|---|---|---|---|
| VFX_SUPER | VFX Supervisor | Artistic intent, UX, workflow correctness, naming | harden/vfx- |
| COMFY_LEAD | ComfyUI Team Lead | ComfyUI API contracts, node compatibility, MCP protocol | harden/comfy- |
| NUKE_COMP | Nuke Compositor | Pipeline integration, I/O patterns, cross-app interop | harden/pipeline- |
| PRODUCER | Producer | CI/CD, packaging, release, docs, metrics, scheduling | harden/ops- |
| SYS_ENG | Systems Engineer | Performance, concurrency, security, error handling, typing | harden/sys- |
Routing Rules (MoE Gating)
Task mentions UI/UX/artist experience → VFX_SUPER
Task mentions ComfyUI API/nodes/MCP → COMFY_LEAD
Task mentions I/O/pipeline/integration → NUKE_COMP
Task mentions CI/docs/packaging/release → PRODUCER
Task mentions perf/security/types/async → SYS_ENG
Task spans multiple domains → Primary + Review by secondary
AND-NODE TASK TREE
All branches must succeed. Hardest branches marked with ⚠️.
PRODUCTION HARDEN (AND — all required)
├── WS-1: Type Safety & Static Analysis (SYS_ENG) ⚠️ HARDEST
│ ├── 1.1 Add py.typed marker + pyright config
│ ├── 1.2 Type-annotate all public APIs (agent/tools/*.py)
│ ├── 1.3 Type-annotate brain layer (agent/brain/*.py)
│ ├── 1.4 Type-annotate core (config, circuit_breaker, rate_limiter, etc.)
│ ├── 1.5 Add pyright to CI (strict mode on new code, basic on existing)
│ └── 1.6 Fix all pyright errors at basic level
│
├── WS-2: Async Architecture Hardening (SYS_ENG + COMFY_LEAD review)
│ ├── 2.1 Audit all sync-in-async bridges (run_in_executor patterns)
│ ├── 2.2 Add proper async context managers for httpx clients
│ ├── 2.3 Fix MCP server graceful shutdown (signal handling)
│ ├── 2.4 Add connection pooling for ComfyUI HTTP calls
│ ├── 2.5 Add timeout configuration (per-tool configurable)
│ └── 2.6 Add async health check endpoint for MCP server
│
├── WS-3: Error Handling & Resilience (SYS_ENG + VFX_SUPER review)
│ ├── 3.1 Audit all exception handlers — no silent swallows
│ ├── 3.2 Add structured error types (ToolError, TransportError, ValidationError)
│ ├── 3.3 Add error context propagation (chain exceptions properly)
│ ├── 3.4 Add circuit breaker metrics (open/close counts, latency p50/p99)
│ ├── 3.5 Add retry budget (prevent infinite retry storms)
│ └── 3.6 Add graceful degradation paths (ComfyUI down → partial functionality)
│
├── WS-4: State Management Hardening (COMFY_LEAD + SYS_ENG review) ⚠️
│ ├── 4.1 Audit all module-level mutable state (6 _instance singletons, _state, _cache)
│ ├── 4.2 Add session-scoped state isolation (remove workflow_patch._state global)
│ ├── 4.3 Add session validation on load (schema versioning, migration)
│ ├── 4.4 Add atomic file writes for sessions (write-tmp + rename)
│ ├── 4.5 Add state cleanup / garbage collection for stale sessions
│ └── 4.6 Add memory limits for in-process caches (_cache in comfy_discover)
│
├── WS-5: Security Hardening (SYS_ENG + NUKE_COMP review)
│ ├── 5.1 Audit path traversal protection (validate_path coverage)
│ ├── 5.2 Add input validation for all MCP tool inputs (jsonschema strict)
│ ├── 5.3 Add rate limiting for MCP tool calls (prevent abuse)
│ ├── 5.4 Add secrets handling audit (.env, API keys, no hardcoded values)
│ ├── 5.5 Add dependency vulnerability scan (pip-audit in CI)
│ └── 5.6 Docker security review (non-root, no unnecessary capabilities)
│
├── WS-6: Testing Hardening (COMFY_LEAD + SYS_ENG)
│ ├── 6.1 Fix Pillow deprecation warnings (getdata → get_flattened_data)
│ ├── 6.2 Add property-based tests for patch engine (hypothesis)
│ ├── 6.3 Add integration test harness (requires live ComfyUI — mark as slow)
│ ├── 6.4 Add test coverage measurement + enforce minimum (pytest-cov)
│ ├── 6.5 Add mutation testing on critical paths (mutmut on workflow_patch)
│ ├── 6.6 Add fuzz testing for workflow JSON parsing
│ └── 6.7 Add MCP protocol conformance tests
│
├── WS-7: Observability & Monitoring (PRODUCER + SYS_ENG)
│ ├── 7.1 Add structured metrics (tool call counts, latencies, error rates)
│ ├── 7.2 Add tool call tracing (correlation ID → tool chain visualization)
│ ├── 7.3 Add performance baselines (benchmark suite for key operations)
│ ├── 7.4 Add memory profiling for long-running MCP sessions
│ ├── 7.5 Add log aggregation-friendly format (OpenTelemetry-compatible)
│ └── 7.6 Add GPU utilization monitoring hooks (RTX 4090 specific)
│
├── WS-8: CI/CD & Packaging (PRODUCER)
│ ├── 8.1 Add Python 3.13 to CI matrix
│ ├── 8.2 Add pyright/mypy check to CI
│ ├── 8.3 Add pip-audit (dependency security) to CI
│ ├── 8.4 Add test coverage gate to CI (fail below threshold)
│ ├── 8.5 Add docker-compose.yml for local dev (ComfyUI + agent)
│ ├── 8.6 Add release automation (version bump, changelog, PyPI publish)
│ ├── 8.7 Add pre-commit hooks config (.pre-commit-config.yaml)
│ └── 8.8 Add Windows-specific CI validation (paths, comfy_cli integration)
│
├── WS-9: Documentation & UX (VFX_SUPER + PRODUCER)
│ ├── 9.1 Add CONTRIBUTING.md (developer onboarding)
│ ├── 9.2 Add CHANGELOG.md (keepachangelog format)
│ ├── 9.3 Update README for production deployment
│ ├── 9.4 Add troubleshooting guide (common errors, ComfyUI connection issues)
│ ├── 9.5 Add MCP tool reference (auto-generated from TOOLS schemas)
│ ├── 9.6 Add architecture diagram (mermaid in docs/)
│ └── 9.7 Audit all user-facing error messages for artist-friendly language
│
├── WS-10: Platform & Config Hardening (NUKE_COMP + SYS_ENG)
│ ├── 10.1 Add config validation on startup (fail fast with clear errors)
│ ├── 10.2 Add platform-aware defaults (Windows/macOS/Linux path handling)
│ ├── 10.3 Add ComfyUI auto-discovery (find running instance, check common ports)
│ ├── 10.4 Add comfy_cli integration (leverage local ComfyUI management)
│ ├── 10.5 Add environment variable documentation (.env.example)
│ └── 10.6 Hardware profile auto-detection (GPU model, VRAM, for optimizer hints)
│
└── WS-11: MCP Protocol Hardening (COMFY_LEAD) ⚠️
├── 11.1 Add MCP resource support (expose workflow state as MCP resources)
├── 11.2 Add MCP prompt support (pre-built prompt templates)
├── 11.3 Add SSE transport option (for remote/web clients)
├── 11.4 Add MCP server versioning (protocol negotiation)
├── 11.5 Add tool schema validation (ensure all schemas are MCP-compliant)
└── 11.6 Add MCP error code compliance (proper JSON-RPC error responses)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 280 lines · 0 tokens per session scan A aa98b4fe18ba
PRODUCTION_HARDEN is a command published in the GitHub repository JosephOIbrahim/Comfy-Cozy (24 stars, last pushed 1mo ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 3,513 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
director
Direct a short film from a story. Generates scenes, frames, and video clips.
compare
Diff two ComfyUI workflows to see what changed.
install
Install a ComfyUI custom node pack.
convert
Convert between ComfyUI UI format and API format workflows.
debug
Diagnose why a ComfyUI workflow failed.
gallery
Browse and inspect generated ComfyUI outputs.