SRL Eval

Every now and then ComfyUI makes you fight the graph to do something that's one line of Python. SRL Eval is the escape hatch: you type a function signature and a body, wire in up to five values, and it runs your code and hands the result back to the workflow. It's the node the pack's README is talking about when it warns that the pack "allows execution of arbitrary code." Full power, and the pack's author is refreshingly honest that he's not trying to make it secure - because ComfyUI itself isn't remotely secure to begin with.

How it works

The source is short and worth understanding. The node builds a function from your two text inputs:

def func({parameters}):
    {your code, indented}

Then it execs that source, maps the five optional inputs (arg0 through arg4) onto your function's parameters by name, fills in defaults itself so *args works, calls the function, and returns whatever it returns - of any type. It explicitly rejects **kwargs and keyword-only arguments, but that's about it. If your code runs, the graph gets the value.

The inputs that matter

• parameters (STRING) - the function signature, e.g. a, b=None, c="foo", *rest. This decides what your code sees.
• code (STRING, multiline) - the function body. Include a return or you'll get None back.
• arg0–arg4 (any) - the values you wire in. Each maps to the parameter of the same name, so a parameter named arg3 pulls from the arg3 input.

The single output is any type, so it'll feed strings, numbers, tensors, whatever your function returns.

What you'd actually use it for

The classic: computed values the graph can't make. Building an upscale dimension - parameters: w, h / code: return f"{w}x{h}". Deriving a seed - return seed % 10000. Computing an index, summing scores, assembling a caption from several inputs, converting a float to an int for a node that demands one. If you've used rgthree's Power Puter, this is its unrestricted, full-function cousin - Power Puter evaluates expressions, SRL Eval runs a whole Python function.

Where people get burned

• Return something. Forget the return and the output is None, which silently breaks whatever it feeds.
• Parameter names matter. A wired value only reaches your code if the signature names it and the arg input matches. Unused args are simply ignored.
• Syntax errors surface at the node, and the traceback lands in ComfyUI's console - read the log, not just the red bubble.
• Globals persist. The code execs against the module's globals, so a bare import os in your body leaves that import sitting in the process for the session. The README warns about this and it's a real gotcha if your code mutates anything shared.
• Security, for real. SRL Eval runs whatever Python you type, as your user, with your GPU and your files. That's not hypothetical: this class of arbitrary-code node is exactly what attackers have been observed dropping onto exposed ComfyUI instances via Manager - a 2026 report on over 1,000 compromised instances listed srl-nodes among the repos attackers install. Keep ComfyUI off the public internet, don't expose the API without auth, and treat any downloaded workflow containing SRL Eval the way you'd treat a stranger's .py file. The author says it plainly in the README: don't use these nodes where untrusted users can control workflows.

Install

The pack has no extra dependencies. Install via ComfyUI Manager (search "SRL's nodes" or "srl-nodes"), or:

cd ComfyUI/custom_nodes && git clone https://github.com/seanlynch/srl-nodes

then restart. No model downloads, no requirements file - just four small Python classes, one of which is this.