🛡️ Jun's Airgap Guard

Most nodes add capability. This one adds a tripwire. 🛡️ Jun's Airgap Guard pokes a URL with a HEAD request every time your workflow runs, and then either lets the queue proceed or kills it on purpose. The whole point is to make "is this machine supposed to be offline right now?" an enforced precondition instead of a hope.

Why would you want that? ComfyUI runs happily with zero internet - every model, node, and weight lives on disk. But there's a real class of setups where being able to reach the network is itself the problem: an air-gapped workstation that must not leak, or a policy that generation happens only offline. People deploying ComfyUI fully offline keep asking the same thing - "are components still reaching out?" This node flips that: instead of auditing your network, it fails the workflow loudly if the network is there at all. There's also the mirror-image case: gate a run on a local service being up - an LLM endpoint, an internal API - and block_if_unreachable does that.

How it actually works

It's gloriously simple under the hood - and that's a feature. The node uses only Python's standard urllib - no requests, no pip packages, nothing to go stale. It builds a HEAD request, times it out, and calls it a day.

Two behaviors trip people up, so get them straight now:

• Any HTTP response counts as "reachable," not just 200. A server that returns 403, 404, or 500 still answered - the node treats that as connectivity and says reachable. If you're testing a site that blocks bots, expect it to read "reachable" regardless.
• Blocking happens by throwing. When the guard trips, it raises a RuntimeError mid-execution, and ComfyUI aborts the run. No output, no warning image - the queue just stops. That's harsh on purpose; a guard that politely warns you is a guard you'll ignore.

The node is flagged as an output node with zero outputs, which is ComfyUI's way of saying "execute me every run even though nothing consumes me." Then it reports back over the websocket and paints a colored badge on itself: gray idle, yellow checking, green reachable, red unreachable, purple for an invalid URL. The badge and messages auto-switch between English and Japanese.

The inputs that matter

There are four, and they're all required:

• url - the target. Only http:// and https:// are accepted; anything else is rejected as invalid.
• timeout_seconds - how long to wait before calling it unreachable. Default 3; fine for most checks.
• mode - the one you'll actually change:
  • block_if_reachable (default) - stop the run if the URL responds. Your "must be offline" mode.
  • block_if_unreachable - stop if it doesn't respond. Your "is my local service up" mode.
  • report_only - never blocks, just shows the badge.
• probe_token - this one's subtle. The node reports a fingerprint of its inputs as its "changed" signal, so ComfyUI will skip re-running it if nothing changed between queues. In ComfyUI V1 that means a check you expect every run quietly doesn't happen. Wire probe_token to a random-integer primitive and the fingerprint changes every run, forcing a fresh probe. Do this - it's the difference between "checked" and "checked the first time."

Installing it

Zero dependencies, zero model files, so this is as painless as node installs get. ComfyUI Manager: search "Jun's Airgap Guard" (or the repo name) and hit install. Or manually:

cd ComfyUI/custom_nodes
git clone https://github.com/wakaya/ComfyUI-JunsAirgapGuard.git

Then restart ComfyUI and reload the browser tab. (Fun fact: the README's own clone command has a typo pointing at a repo that doesn't exist - use the URL above.)

Where people get burned

• HEAD support. Some servers - CDNs especially - reject or ignore HEAD requests, which reads as unreachable. If a check fails for no obvious reason, try a URL you know answers HEAD, like a local API endpoint.
• It's a single URL, not an internet detector. The README is blunt: this checks reachability of one target, not absolute on/off state. A dead website doesn't mean you're offline. Point it at something meaningful - https://example.com is the default but a garbage one if you care about real signal.
• Forgetting the probe token. The single most common way to think the guard is working when it isn't.

It's a niche tool - most people will never need it, and that's fine. But if "did this box actually lose network access before I hit queue?" is a question you have to answer defensibly, it's a ten-second install for a guarantee. The author pairs it with outbound-control tools like Airgap Tray, and that's the right mental model: it doesn't cut your network, it just refuses to pretend the network isn't there.