Scan Model (TensorTrap)

The pitch

Model files are the most trusted thing in ComfyUI and one of the least deserved. A .ckpt checkpoint is a Python pickle - loading it can execute arbitrary code, which is exactly why the community moved to .safetensors. But "safetensors means safe" is a comfortable oversimplification. TensorTrap's scanner also hunts polyglot attacks (malware hiding in an image or video that passes as a model), archive-bypass exploits (CVE-2025-1889, CVE-2025-1716), and obfuscation layered on top of the file. The format check is the floor, not the ceiling.

Scan Model (TensorTrap) is the node that runs this scan inside a workflow, right before a model loader, and - by default - refuses to let the workflow continue if the file fails.

How it works

Give it a path. It calls the same scan_file engine that powers the tensortrap CLI, which inspects the file for:

• Malicious pickle opcodes - os.system, subprocess, eval, exec
• Polyglot payloads
• Archive bypass exploits
• Base64/hex obfuscation

Then it returns a JSON report and an is_safe verdict. The engine skips hashing by default (compute_hash=False), so this is a read-and-inspect scan rather than a checksum operation - meaningfully faster on multi-gigabyte checkpoints.

Two honest edge cases baked into the code: if the path doesn't exist you get is_safe = False with "File not found" - that's a path problem, not a security verdict. And if the tensortrap package isn't installed, the report says so instead of crashing.

Inputs and outputs

• model_path (required STRING) - a literal path like models/checkpoints/foo.safetensors. This is a text field, not the loader's dropdown.
• block_on_threat (default true) - raise and stop the queue when a finding at or above min_severity appears.
• min_severity (default HIGH) - the CRITICAL / HIGH / MEDIUM / LOW cutoff. LOW is paranoid mode.

Three outputs:

• model_path - passes your path straight through, so wire it into your path-based loader (e.g. Load Diffusion Model).
• scan_report - STRING JSON; wire it to a Show Text node if you want to read the findings.
• is_safe - BOOLEAN, for a Conditional / Switch node.

How to install it

The pack installs like any custom node:

cd ComfyUI/custom_nodes
git clone https://github.com/realmarauder/ComfyUI-TensorTrap.git
pip install tensortrap

Restart ComfyUI, or search "TensorTrap" in ComfyUI Manager. This is the one node that genuinely needs the tensortrap pip package - it is the scan engine. If your scan_report ever says "TensorTrap not installed", that's the pip line to run.

The catch: CheckpointLoaderSimple

There's a real gotcha. The most common loader in ComfyUI, CheckpointLoaderSimple, selects models through a dropdown - there's no path to feed this node. The README's answer is right: skip the node for dropdown loaders and run the CLI on the file instead:

tensortrap scan models/checkpoints/foo.safetensors

Same engine, same findings, no workflow wiring. Scan Model earns its place on path-based loaders and whenever you want is_safe wired into a conditional. And if you get "File not found", remember paths resolve against the directory where you launched ComfyUI - use the models/...-relative path or the full absolute path.