Flora proves an npm publish is out.

npm saying "published" doesn't mean people can install it. The public listing can lag, the wrong version can go out, or the files aren't the ones you built. Flora reads the public registry and fetches the file npm serves, then checks it byte for byte against what you packed. Only an exact match is PUBLISHED.

Install Flora Price

A$0.01 a check, from your GOL balance. The public npm registry. Tested on Windows. Node 18 or newer.

1. Get your key at the console: the same key and balance as Check. 2. Add Flora to Claude Code. 3. Restart Claude Code.

claude mcp add flora --scope user -- npx -y @golproductions/flora mcp

Or publish and prove in one step

npx @golproductions/flora publish
Flora reads your key from the GOL_KEY environment variable, or from ~/.check/key, where Check keeps it.
01

How it works.

Three steps, every publish.

01Pack.
Flora reads your package's fingerprint from npm pack.npm packs the same files the same way every time.
02Publish.
The way you always do, or with flora publish.
03Prove.
Flora reads the public registry and fetches the published file. Only an exact match is PUBLISHED.If the listing is slow, Flora waits up to 60 seconds inside the same check.

A real result.

Flora's first job, 2 November 2026: proving Jogga and Flora were out, minutes after publishing. Then a copy with one file changed.

PUBLISHED: @golproductions/jogga@1.0.1 is listed, and the file npm serves matches what you packed, byte for byte. (A$0.01) PUBLISHED: @golproductions/flora@1.0.0 is listed, and the file npm serves matches what you packed, byte for byte. (A$0.01) NOT PUBLISHED: @golproductions/jogga@1.0.0 is on npm, but it isn't what you packed. Its files differ from yours. (A$0.01)
02

What it checks.

Every answer comes from the public npm registry.

Listed publicly
The package can be found by anyone, not only in your account.
The right version
Your version is there. If it isn't, Flora names the latest version npm has.
The files you packed
npm's fingerprint for the version against the one from your folder.
The file npm serves
Flora downloads the published file and checks it against npm's own listing.
03

What it won't catch.

Where the registry can't prove it, Flora doesn't claim it.

Other registries
Private registries, GitHub Packages and company mirrors.
Whether the code is right or safe
A matching file proves it's what you packed, not that it works or is safe.
Installs blocked on the user's side
Settings like a minimum release age, or a company proxy, can still hold a new version back.
04

Price.

Charged per check, from the balance you already have.

A$0.01 a check
From your GOL balance: the same key and balance as Check. Top up at the console.
Not charged
A wrong key, bad input, or when npm can't be reached.
Too low a balance
No answer is given, and nothing is charged.
One check, one charge
Waiting for a slow listing happens inside the same check.
05

Your data.

What leaves your machine.

Sent
Your GOL key, the package name, the version and its fingerprint.
Never sent
Your code or your files.
Kept
Each charge on your account: the time, A$0.01, "flora", and the package name and version. To limit abuse, Flora's server counts requests per IP address, minute by minute.
06

Questions it answers.

The problems people ask about, answered in full.

My npm package page returns 404, but the tarball downloads

npm says published. Make sure.

A$0.01 a check, from your GOL balance.

Get a key Install Flora

Flora compares the package npm serves with the package you packed. It doesn't test whether the code works or is safe, and nothing here claims it makes a release safe. The service is provided "as is" and "as available", subject always to your rights under the Australian Consumer Law, which cannot be excluded and which nothing on this site limits. See our terms for details. Questions or feedback: support@golproductions.com.