IO & Workflow

The IO & Workflow node is what you reach for when your workflow stops being a single image and starts being a pipeline. Its mode dropdown holds 23 operations: filesystem (mkdir, exists, glob, copy, move, delete), path manipulation, HTTP GET/POST, webhook and console notifications, a filename formatter, save-image-with-manifest, save-images-to-ZIP, parameter sweeps, a folder watcher, system stats (RAM/disk/GPU), and workflow stop/assert. Outputs are text, parsed (a DICT), image, and status_code (INT).

The modes that earn the install: filename_format builds filenames from tokens - {date}, {time}, {datetime}, {seed}, {prompt_slug}, {ext} - which is the unglamorous thing every batch workflow needs. save_image_with_manifest writes your image plus a .json sidecar of metadata, so you get a searchable archive instead of a folder of anonymous PNGs. save_images_zip (new in v0.3) packs an IMAGE batch into a single ZIP with a manifest.json, which is perfect for sweeps where you want one downloadable artifact instead of forty loose files. And sweep_param emits a list of values you can feed into an X/Y-plot-style workflow to scan a parameter range.

How it works

Standard pack skeleton - mode dispatches to the registered op, unused outputs pad. The pieces that matter:

• HTTP: http_get and http_post take url, headers_json, body_json, and timeout_seconds, and return the response text, a parsed JSON DICT (empty if it wasn't JSON), and the status_code. Responses are capped at 50 MB and the timeout defaults to 30 s.
• Filesystem: fs_mkdir, fs_exists, fs_glob, fs_copy, fs_move, fs_delete take path/src/dst/pattern/recursive. fs_delete refuses directories and wants missing_ok explicitly if the file might already be gone.
• notify_webhook POSTs {"message": ...} to your url and returns the status code; notify_console prints to the log.
• watch_folder_next returns the newest file matching extensions in a folder, optionally polling up to wait_seconds.

Installing it

It ships with the pack:

cd ComfyUI/custom_nodes
git clone https://github.com/IxMxAMAR/ComfyUI-Utility-MegaPack

Restart ComfyUI or use ComfyUI Manager → "Utility-MegaPack". No model files. The HTTP ops need requests, which is in the pack's deps.

Where people get tripped up

This is the pack's most security-conscious node, and the safeguards are the thing that surprises people. Filesystem write/delete ops are confined to ComfyUI's input/output/temp roots - if you point fs_move at ~/.ssh, you get a PermissionError, not a moved file. Set UTILITY_MEGAPACK_ALLOW_ARBITRARY_PATHS=1 if you genuinely need broader access (README's wording: use with care). Likewise, http_get, http_post, and notify_webhook block requests to localhost and private ranges by default as an SSRF guard - so your local webhook or LAN service will be refused until you set UTILITY_MEGAPACK_ALLOW_INTERNAL_HTTP=1. Both guards exist because this pack had a v0.3 audit that fixed real path-traversal and SSRF holes, and it's the right trade. Two quieter gotchas: save_image_with_manifest strips your filename to its basename to block ../ traversal, so nested paths won't survive; and workflow_stop deliberately raises when condition is true - that's how it stops the run, so don't wire it and wonder why your queue aborts.