[GH-ISSUE #3] get_output returns signed URLs with invalid GCS signatures #2

New issue

Closed

opened 2026-10-26 22:27:38 +00:00 by bsakaguchi · 2 comments

bsakaguchi commented

2026-10-26 22:27:38 +00:00

Owner

Originally created by @lovelybbq on GitHub (Apr 4, 2026).
Original GitHub issue: https://github.com/Comfy-Org/comfy-cloud-mcp/issues/3

When using the comfyui-cloud MCP server from Claude Code, get_output can return signed GCS URLs with invalid signatures. Downloading these URLs produces 869-byte files with .png extensions that contain XML error data instead of image content. The files cannot be opened.

GCS error in the corrupt files

<?xml version='1.0' encoding='UTF-8'?>
<Error>
  <Code>SignatureDoesNotMatch</Code>
  <Message>Access denied.</Message>
  <Details>The request signature we calculated does not match the signature
    you provided. Check your Google secret key and signing method.</Details>
</Error>

Verified corrupt file analysis

All 5 downloaded files (portrait_00_base.png through portrait_04_fd4.png) are 869-byte XML documents misidentified as PNGs. Each references a different GCS object path under /comfy-cloud-assets/ and was signed individually within a ~2 second window (20260404T174907Z–20260404T174909Z). All 5 signatures are invalid.

portrait_00_base.png: XML 1.0 document text, ASCII text (869 bytes)
portrait_01_fd1.png:  XML 1.0 document text, ASCII text (869 bytes)
portrait_02_fd2.png:  XML 1.0 document text, ASCII text (869 bytes)
portrait_03_fd3.png:  XML 1.0 document text, ASCII text (869 bytes)
portrait_04_fd4.png:  XML 1.0 document text, ASCII text (869 bytes)

Steps to reproduce

In Claude Code, run:

/comfy-generate-image Make a ComfyUI workflow that generates a portrait using dreamshaper_8 checkpoint, then runs it through 4 chained FaceDetailer nodes (using UltralyticsDetectorProvider with bbox/face_yolov8m.pt). Each FaceDetailer output should have its own SaveImage node, so there are 5 total output images.
Wait for the job to complete and let Claude download all outputs
Some or all of the signed URLs returned by get_output may have invalid signatures
Downloading those broken URLs produces 869-byte XML error files instead of PNGs

Key observations

Retrying get_output generates new URLs with new dates/signatures, and sometimes the newly generated URLs work correctly
The signed URLs have a 6-hour expiry (X-Goog-Expires=21599), so expiration is not the cause

Environment

Platform: macOS 26.4
Client: Claude Code (CLI)
Tool: comfyui-cloud MCP server

Originally created by @lovelybbq on GitHub (Apr 4, 2026). Original GitHub issue: https://github.com/Comfy-Org/comfy-cloud-mcp/issues/3 When using the `comfyui-cloud` MCP server from Claude Code, `get_output` can return signed GCS URLs with invalid signatures. Downloading these URLs produces 869-byte files with `.png` extensions that contain XML error data instead of image content. The files cannot be opened. ## GCS error in the corrupt files ```xml <?xml version='1.0' encoding='UTF-8'?> <Error> <Code>SignatureDoesNotMatch</Code> <Message>Access denied.</Message> <Details>The request signature we calculated does not match the signature you provided. Check your Google secret key and signing method.</Details> </Error> ``` ## Verified corrupt file analysis All 5 downloaded files (`portrait_00_base.png` through `portrait_04_fd4.png`) are 869-byte XML documents misidentified as PNGs. Each references a different GCS object path under `/comfy-cloud-assets/` and was signed individually within a ~2 second window (`20260404T174907Z`–`20260404T174909Z`). All 5 signatures are invalid. ``` portrait_00_base.png: XML 1.0 document text, ASCII text (869 bytes) portrait_01_fd1.png: XML 1.0 document text, ASCII text (869 bytes) portrait_02_fd2.png: XML 1.0 document text, ASCII text (869 bytes) portrait_03_fd3.png: XML 1.0 document text, ASCII text (869 bytes) portrait_04_fd4.png: XML 1.0 document text, ASCII text (869 bytes) ``` ## Steps to reproduce 1. In Claude Code, run: > /comfy-generate-image Make a ComfyUI workflow that generates a portrait using dreamshaper_8 checkpoint, then runs it through 4 chained FaceDetailer nodes (using UltralyticsDetectorProvider with bbox/face_yolov8m.pt). Each FaceDetailer output should have its own SaveImage node, so there are 5 total output images. 2. Wait for the job to complete and let Claude download all outputs 3. Some or all of the signed URLs returned by `get_output` may have invalid signatures 4. Downloading those broken URLs produces 869-byte XML error files instead of PNGs ## Key observations - Retrying `get_output` generates new URLs with new dates/signatures, and sometimes the newly generated URLs work correctly - The signed URLs have a 6-hour expiry (`X-Goog-Expires=21599`), so expiration is not the cause ## Environment - **Platform:** macOS 26.4 - **Client:** Claude Code (CLI) - **Tool:** `comfyui-cloud` MCP server

bsakaguchi closed this issue

2026-10-26 22:27:38 +00:00

bsakaguchi commented

2026-10-26 22:27:39 +00:00

Author

Owner

@mattmillerai commented on GitHub (Apr 7, 2026):

Thanks for the detailed report — this was extremely helpful.

We've identified the root cause and a fix is staged on our backend. It will roll out with the next deployment, after which the intermittent failures should be gone.

We've also shipped a defensive workaround in the MCP server itself so corrupt downloads should stop appearing even before the backend fix lands.

Will update this issue once the deploy goes out.

@mattmillerai commented on GitHub (Apr 7, 2026): Thanks for the detailed report — this was extremely helpful. We've identified the root cause and a fix is staged on our backend. It will roll out with the next deployment, after which the intermittent failures should be gone. We've also shipped a defensive workaround in the MCP server itself so corrupt downloads should stop appearing even before the backend fix lands. Will update this issue once the deploy goes out.

bsakaguchi commented

2026-10-26 22:27:39 +00:00

Author

Owner

@mattmillerai commented on GitHub (Jun 22, 2026):

Migrated to Comfy-Org/comfy-cloud-mcp-server#429 (this installer repo is being archived). Tracking there.

@mattmillerai commented on GitHub (Jun 22, 2026): Migrated to Comfy-Org/comfy-cloud-mcp-server#429 (this installer repo is being archived). Tracking there.

bsakaguchi referenced this issue

2026-10-26 22:27:47 +00:00

[PR #2] [MERGED] fix: Claude Desktop requires OAuth, fix Amp config, add slash commands #6