Add Comfy-MSS to custom-node-list.json

[SUC-DriverOld]

Add Comfy-MSS to custom-node-list.json

repo url: https://github.com/pymss-project/comfy-mss

ComfyUI-MSS provides ComfyUI nodes for music source separation powered by pymss. It supports both built-in pymss model catalog entries and user-provided MSST models, allowing workflows to separate an input audio track into stems such as vocals, instrumental, drums, bass, and other sources.

Included nodes

• MSS Separate: separates a ComfyUI AUDIO stream with catalog MSS/non-VR pymss models.
• MSS Separate List: list-output variant of MSS Separate.
• Custom MSS Separate: separates audio with user-provided MSS models from the custom model folder.
• Custom MSS Separate List: list-output variant of Custom MSS Separate.
• VR Separate: separates a ComfyUI AUDIO stream with VR/UVR pymss models.
• VR Separate List: list-output variant of VR Separate.
• MSS Params: optional parameter input for MSS Separate and Custom MSS Separate.
• VR Params: optional parameter input for VR Separate.
• Load Audio: loads one audio file and outputs both the audio stream and the file name without extension.
• Load Audio Batch: loads audio files from a folder as ComfyUI list outputs.
• Audio Invert Phase: inverts audio input a and outputs -a.
• Audio Normalize: normalizes only when the peak is above 0 dBFS.
• Audio Ensemble: combines 2 to 10 audio inputs with selectable ensemble algorithms and weights.
• Save Audio: saves ComfyUI AUDIO streams as wav, flac, or mp3.

For more details, visit https://github.com/pymss-project/comfy-mss

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: bede325a-f09e-4211-8538-26e781459613

📥 Commits

Reviewing files that changed from the base of the PR and between fe1193c and 11f3cb0.

📒 Files selected for processing (1)

• custom-node-list.json

---

📝 Walkthrough

Walkthrough

The custom node registry now includes a Comfy-MSS entry with repository metadata, Git-clone installation details, and a description of its music source separation nodes.

Changes

Comfy-MSS Registry

Layer / File(s)	Summary
Add Comfy-MSS registry metadata custom-node-list.json	Adds the author, repository, Git-clone installation source, and description for Comfy-MSS. The description covers musical stem separation with built-in or user-provided MSST models. Mischief meets music.

Possibly related PRs

• Comfy-Org/ComfyUI-Manager#3115: Adds another custom node entry to the same registry.
• Comfy-Org/ComfyUI-Manager#3118: Adds repository metadata and Git-clone installation details to the registry.
• Comfy-Org/ComfyUI-Manager#3120: Adds a custom node entry using the same registry structure and installation type.

Suggested reviewers: ltdrdata, demonalone, 0xbeycan

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

✨ Simplify code

• Create PR with simplified code

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[SUC-DriverOld]

@ltdrdata

Hi ltdrdata, sorry to bother you.
I just wanted to kindly follow up on my PR, it's been over 20 days since I submitted it and I haven't received any review yet. I totally understand you're busy, but if you have a moment, I'd really appreciate it if you could take a look.
I'm not very familiar with ComfyUI's codebase and some of the internal methods, so there might be issues with my implementation. I'm more than happy to make changes if you can point out what needs to be fixed.
Thanks again for your time and help!

[ltdrdata]

1. The PymssLoadAudioBatch folder widget value is read from an unconfined path (absolute and .. accepted), so a graph can read audio files from anywhere the server can reach.
   • comfy_mss/nodes/io.py:43
2. POST /comfy-mss/upload-audio is an open route with no access control that writes an uploaded file to disk, so any remote caller can write files on the server.
   • comfy_mss/services/routes.py:51
3. The node UI strings are localized to Chinese/Japanese/Korean via an i18n table, so the button and status labels render in a non-English language.
   • web/comfy_mss/i18n.js

Please confine the read path to a fixed base directory (realpath + commonpath, reject absolute and ..), make the upload route local-only or remove it, and write the UI strings in English. For multilingual support, refer to the locale feature: Comfy-Org/ComfyUI#6558

I'll re-evaluate once these are addressed.

[SUC-DriverOld]

Hi @ltdrdata . Thank you for pointing out these issues. I have addressed them as follows:

• Removed the unsafe PymssLoadAudioBatch node and its related registrations, locale entries, and example workflow.
• Kept the Upload Audio button, but restricted /comfy-mss/upload-audio to local clients only (comfy_mss/services/routes.py:30-36).
• Uploads are always saved under ComfyUI's input directory, with filename validation and realpath/commonpath checks to prevent path traversal.
• Migrated node and button translations to ComfyUI and Manager's official locale system using locales/<language>/main.json and /i18n.

I would appreciate it if you could kindly take another look at the revisions. If anything is still not quite right, I will be happy to make further corrections.