crossref-mcp-server-216ddf — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited crossref-mcp-server-216ddf (Plugin) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<div align="center"> <h1>@cyanheads/crossref-mcp-server</h1> <p><b>Resolve DOIs, search ~188M scholarly works, fetch references, and look up publishers via the Crossref REST API. STDIO or Streamable HTTP.</b> <div>7 Tools • 1 Resource</div> </p> </div>
<div align="center">
</div>
<div align="center">
</div>
<div align="center">
Public Hosted Server: https://crossref.caseyjhand.com/mcp
</div>
Scholarly metadata from the Crossref REST API. Resolve DOIs to full metadata records, search across ~188 million scholarly works by free text or structured filters, fetch outgoing reference lists, and look up journals, funders, and publishers.
| Tool | Description |
|---|---|
crossref_get_work | Resolve a DOI to its full Crossref metadata record: title, authors, editors, affiliations, abstract, journal with volume/issue/pages, ISSNs and ISBNs, publication date, license, full-text links, funder acknowledgements, post-publication updates, and related identifiers |
crossref_search_works | Search the Crossref works index by free text and/or structured filters, with field-scoped query parameters, sort, field selection, and offset or cursor-based paging |
crossref_get_references | Return the outgoing reference list for a DOI — the works cited by this paper, with citation strings and resolved DOIs where available |
crossref_search_journals | Find Crossref journal records by ISSN or title query; optionally retrieve a page of the journal's most recent works |
crossref_search_funders | Find funders in the Crossref Funder Registry by name, registry ID, or funder DOI; optionally retrieve a page of funded works |
crossref_get_member | Resolve a Crossref member ID to its publisher record — name, owned DOI prefixes, DOI counts, and per-category metadata deposit coverage |
crossref_get_prefix | Resolve a DOI prefix (e.g. 10.1038) to its owning publisher, chaining into crossref_get_member |
| Resource | Description |
|---|---|
skill://crossref-guide/SKILL.md | Agent Skill crossref-guide: judgment for the crossref_* tools — confirming a citation match, choosing between the journal/funder works lists and a filtered works search, Crossref filter syntax, DOI prefix versus current publisher, and deposit-dependent coverage |
The skill is also served through the skill://{+path} template and ships as skills/crossref-guide/SKILL.md in the npm package, the Docker image, the .mcpb bundle, and plugin installs. The tools do not depend on it.
crossref_get_work <sub>tool</sub>10.NNNN/suffix regex before the upstream call, accepted either bare or wrapped in its resolver (https://doi.org/…, https://dx.doi.org/…, doi:…) and unwrapped before the lookupvolume, issue, page, and articleNumber under the same names and on the same rendered line as crossref_search_works, plus isbn — each as deposited, omitted when absenteditors in the author entry shape, returned whole and never counted in authorCountoffset/limit (default 25, up to 500 per call — a larger limit is clamped to 500 with a notice); authorCount reports the full deposited total and a nextOffset continues when authors remain — every other field is returned in full on every pageupdatedBy lists the corrections, retractions, expressions of concern, and new versions Crossref records against the work — notice DOI, type, source (publisher or retraction-watch, with its record ID), and date, entry for entry — and updateTo the works this record is a notice for; when updatedBy is present, notice names each update type with its sources. An absent updatedBy does not mean the work was never updatedrelations groups related identifiers (preprint ↔ published version, versions, reviews, supplements) by relation type, identifier type, and asserting party, returned whole; only Crossref-registered DOIs among them resolve through this toolror in place of name, never as a blank entrypublished, published-print, published-online, and issued (this tool only) that names a value; a date component Crossref records as unknown is omitted, along with everything less precise below itreferencesCount) — entries come from crossref_get_references; incoming citation count (isReferencedByCount) is included, but citing works are not exposed by Crossref — use OpenAlex for citation graphsdoi_not_found naming the agency the DOI registry says holds it (registrationAgency — DataCite, JaLC, mEDRA, …), a Funder Registry pointer when Crossref registered it, or that no agency registered it at allcrossref_search_works <sub>tool</sub>query plus a structured filter object using Crossref's hyphenated keys (from-pub-date, type, funder, issn, has-abstract, license.url, etc.)queryTitle, queryAuthor, queryContainerTitle, and queryBibliographic combine with query and with each otherrelevance, score, is-referenced-by-count, published, deposited, or other listed fields — the publication-date sorts page by offset only, since Crossref refuses them with a cursor. A cursor walk with a query term and no sort runs by relevance (sent as sort=score, without order) and can repeat or skip a record at a page boundary; sort: "created" walks without repeats. A filter-only walk runs in Crossref registration orderfields narrows the payload to any of the 19 select names the summary projects — including the citation locators volume, issue, page, article-number, and ISSN, and the update links updated-by and update-to — and refuses any other name; DOI is always returned, and crossref_get_work carries the rest of the recordupdatedBy (corrections, retractions, expressions of concern, new versions recorded against it) and updateTo (the works it is a notice for) in the entry shape and rendered line crossref_get_work uses, so a page of results can be screened for retractions without a call per DOIsort or order, is read as omitted; when that leaves nothing to search by, the notice says the page is an unfiltered listingrows returns up to 100 works per call and authorLimit caps authors per work (default 25, up to 500); a larger value of either is clamped to its cap with a notice, which on an offset page also names the offset that continues after the records returned (and, near the ~10K ceiling, the smaller rows that still fits beside it); authorCount reports the full deposited total — chain a cut work's DOI into crossref_get_work for the restoffset + rows ≤ 10,000; a rejected offset below the cap names the rows that still fit, and cursor="*" starts deep paging via chained nextCursor tokens — cursor and offset cannot be combinednextCursor — an empty page never carries one; every empty page's notice names which of the three causes appliescrossref_get_references <sub>tool</sub>crossref_get_work acceptscrossref_get_work, with doiAssertedBy saying whether the publisher deposited that DOI or Crossref matched itvolumeTitle, which stands in as the title when there is no article title), series title, volume, issue, first page, edition, and ISSNoffset/limit (default 100, up to 500 per call — a larger limit is clamped to 500 with a notice); referenceCount is the full deposited total and nextOffset continues when more remaindoi_not_found naming its registration agency (registrationAgency), or saying no agency registered it, the same way crossref_get_work doescrossref_search_journals <sub>tool</sub>include_works: true also returns a page of the journal's most recent works — newest published first by works_offset, newest registered first on a works_cursor walk; requires an unambiguous journal — a title query matching more than one returns ambiguous_journal, naming candidates and ISSNscrossref_get_member gives per publisherissn lookup also returns DOI counts by issued year, ascending; title-query results omit themoffset (ceiling offset + rows ≤ 100,000); the works list pages separately by works_offset (ceiling ≤ 10,000) — an offset past the end of either list carries a notice naming it, and so does a page that stalls at either ceiling, along with the offset and smaller rows that reach the last records below itworks_cursor="*" pages the works list with no ceiling via chained nextWorksCursor tokens; a cursor walk runs by Crossref registration date, newest first (Crossref does not walk a publication-date sort by cursor), and cannot combine with works_offset > 0 (works_cursor_offset_conflict)include_works is skipped with a notice rather than returning an empty listcrossref_search_funders <sub>tool</sub>query, a bare registry ID (100000001), or a full funder DOI (10.13039/100000001, optionally behind a doi:/https://doi.org/ prefix)include_works: true also returns a page of funded works; requires an unambiguous funder — a name query matching more than one returns ambiguous_funder, naming candidates and registry IDsoffset (ceiling ≤ 100,000); the funded-works list pages separately by works_offset (ceiling ≤ 10,000) or, with no ceiling, works_cursor="*" chaining nextWorksCursor — offset pages run newest published first, a cursor walk newest registered first, and the two cannot combine (works_offset > 0); an offset past the end of either list carries a notice naming it, and a page that stalls at either ceiling names the offset and smaller rows that reach the last records below itcrossref_search_works filter on {"funder": "10.13039/<id>"} does notnotice names the superseding ID via replacedBy; the replacement is never followed automaticallycrossref_get_member <sub>tool</sub>crossref_get_prefix to resolve a DOI prefix to the member ID firstcrossref_get_prefix <sub>tool</sub>10.1038, no /suffix)crossref_get_member for the full recordprefix_not_found naming the agency that registered it (registrationAgency, e.g. DataCite for 10.5281), or saying no agency registered itBuilt on @cyanheads/mcp-ts-core: stdio and Streamable HTTP transports, pluggable auth (none / jwt / oauth), swappable storage (in-memory, filesystem, Supabase, Cloudflare KV/R2/D1), structured logging with optional OpenTelemetry tracing.
Crossref-specific:
User-Agent header injected on every Crossref request — priority access via CROSSREF_MAILTO, keyless otherwise; no API token requiredRetry-After), 5xx, HTTP 408/504, and network failures; a malformed response body and a request that hits CROSSREF_TIMEOUT_MS are not retriedunknown_filter (with the hyphenated key when Crossref lists one), invalid_parameter, sort_cursor_conflict, invalid_cursor — carrying the rejected inputs and a recovery hint; a malformed issn filter value is refused before the request, and no upstream error relays Crossref's raw response bodyx_i, A^{−1}, √(m), (a+b)/cAgent-friendly output:
doi, issn, and date fields without re-verificationnotice saying which, and so does the page that ends a crossref_search_works cursor walk; a journal or funder works walk ends on the page that omits nextWorksCursornextCursor, nextOffset, nextWorksOffset, and nextWorksCursor continuation fields are withheld once a list is exhausted, and a page that stops at an offset ceiling says so in its notice; a cursor token can still ride the last partial page, and the empty page after it carries noneambiguous_journal and ambiguous_funder list every candidate and its identifier in the error data rather than silently resolving to the first matchConnect to the hosted instance, no install:
claude mcp add --transport http crossref-mcp-server https://crossref.caseyjhand.com/mcpOr run it locally:
claude mcp add crossref-mcp-server -- npx -y @cyanheads/crossref-mcp-serverFor other clients, add this to the MCP config file:
{
"mcpServers": {
"crossref-mcp-server": {
"command": "npx",
"args": ["-y", "@cyanheads/crossref-mcp-server"]
}
}
}Setting CROSSREF_MAILTO to your email moves requests into Crossref's polite pool, which has higher rate limits than the anonymous pool; no account or token is needed. For Docker or a source build, see Running the server.
All configuration is validated at startup via Zod schemas in src/config/server-config.ts.
| Variable | Description | Default |
|---|---|---|
CROSSREF_MAILTO | Email address embedded in the polite-pool User-Agent header of every Crossref request. Optional — server starts without it but logs a warning and uses the anonymous pool with stricter rate limits. Never sent to the DOI registry: the agency lookup after a Crossref not-found identifies the server and version only. | — |
CROSSREF_BASE_URL | Crossref API base URL. Override for testing against a local proxy. The agency lookup after a Crossref not-found always goes to https://doi.org, whatever this is set to. | https://api.crossref.org |
CROSSREF_TIMEOUT_MS | Per-request timeout in milliseconds. Also the worst-case wait against an unresponsive upstream — a request that hits the deadline is not retried. | 10000 |
MCP_TRANSPORT_TYPE | Transport: stdio or http. | stdio |
MCP_SESSION_MODE | HTTP session mode: auto, stateful, or stateless. This server needs no multi-round input, so src/index.ts declares stateless; Docker and .env.example pin the same value, and setting this variable overrides the declaration. | stateless (declared in src/) |
MCP_HTTP_PORT | Port for the HTTP server. | 3010 |
MCP_AUTH_MODE | Auth mode: none, jwt, or oauth. | none |
MCP_LOG_LEVEL | Log level (RFC 5424). | info |
LOGS_DIR | Directory for log files (Node.js only). | <project-root>/logs |
LOG_TOOL_FAILURE_PAYLOADS | Log each failed tool call's arguments and result, redacted by key name and capped at LOG_TOOL_FAILURE_PAYLOAD_MAX_BYTES (default 16384). A secret inside a free-form value is not redacted. | false |
OTEL_ENABLED | Enable OpenTelemetry instrumentation. | false |
See .env.example for the full list of optional overrides.
Requires Bun v1.4.0 or higher (or Node.js v24+).
git clone https://github.com/cyanheads/crossref-mcp-server.git
cd crossref-mcp-server && bun install
cp .env.example .env # optionally set CROSSREF_MAILTO # One-time build
bun run rebuild
# Run the built server
bun run start:stdio
# or
bun run start:http bun run devcheck # Lint, format, typecheck, security
bun run test # Vitest test suite
bun run lint:mcp # Validate MCP definitions against specdocker run --rm -e [email protected] -p 3010:3010 ghcr.io/cyanheads/crossref-mcp-server:latestThe image defaults to HTTP transport, stateless session mode, and logs to /var/log/crossref-mcp-server. To run it over stdio from an MCP client, use "command": "docker" with "args": ["run", "-i", "--rm", "-e", "MCP_TRANSPORT_TYPE=stdio", "ghcr.io/cyanheads/crossref-mcp-server:latest"]. To build locally, docker build -t crossref-mcp-server .; OpenTelemetry peer dependencies are installed by default — build with --build-arg OTEL_ENABLED=false to omit them.
| Directory | Purpose |
|---|---|
src/index.ts | createApp() entry point — registers tools and inits services. |
src/config | Server-specific environment variable parsing and validation with Zod. |
src/mcp-server/tools | Tool definitions (*.tool.ts). |
src/services/crossref | CrossrefService — HTTP client, polite-pool header, retry, pagination helpers. |
skills/ | Published Agent Skill (crossref-guide), served over MCP and shipped with the package. |
tests/ | Unit and integration tests mirroring src/. |
See CLAUDE.md for development guidelines and architectural rules. The short version:
try/catch in tool logicctx.log for request-scoped logging, ctx.state for tenant-scoped storagesrc/mcp-server/tools/definitions/index.tsIssues are welcome. Run checks and tests before submitting:
bun run devcheck
bun run testApache-2.0 — see LICENSE for details.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.