crossref-mcp-server-216ddf — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited crossref-mcp-server-216ddf (Plugin) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<div align="center"> <h1>@cyanheads/crossref-mcp-server</h1> <p><b>Resolve DOIs, search ~155M scholarly works, and fetch references via the Crossref REST API. STDIO or Streamable HTTP.</b> <div>5 Tools</div> </p> </div>
<div align="center">
</div>
Five tools for working with Crossref data — DOI resolution, full-text search across all scholarly works, outgoing reference lists, and journal/funder lookup:
| Tool | Description |
|---|---|
crossref_get_work | Resolve a DOI to its full Crossref metadata record: title, authors, affiliations, abstract (when deposited), journal, publication date, type, license, full-text links, funder acknowledgements, and outgoing reference list |
crossref_search_works | Search the Crossref works index by free text and/or structured filters. Supports sort, field selection, and cursor-based deep paging. |
crossref_get_references | Return the outgoing reference list for a DOI — the works cited by this paper, with raw citation strings and resolved DOIs where available |
crossref_search_journals | Find Crossref journal records by ISSN or title query; optionally retrieve the journal's most recent works |
crossref_search_funders | Find funders registered in the Crossref Funder Registry by name or funder DOI; optionally retrieve funded works |
crossref_get_workResolve a DOI to its canonical Crossref record.
10.NNNN/suffix regex before the upstream callis-referenced-by-count) is included; citing works are not — Crossref does not expose that data. Use OpenAlex for citation graphs.crossref_search_worksSearch across ~155M Crossref-registered works.
query plus a structured filter object using Crossref's hyphen-separated key syntax: from-pub-date, until-pub-date, type, funder, issn, member, has-abstract, has-references, has-full-text, directory (use DOAJ to restrict to open-access content)relevance, is-referenced-by-count, published, deposited, or scorefields parameter narrows response payload — useful for large result setscursor=* on the first call, then pass the returned next-cursor token. Cursor and offset cannot be combined.crossref_get_referencesFetch the outgoing reference list for a DOI.
crossref_search_journalsFind journal records by ISSN or title.
include_works: true triggers a second upstream call to fetch the journal's most recent workscrossref_search_fundersFind funders in the Crossref Funder Registry.
include_works: true retrieves funded works for the matched funderBuilt on @cyanheads/mcp-ts-core:
none, jwt, oauth)in-memory, filesystem, Supabase, Cloudflare KV/R2/D1Crossref-specific:
User-Agent header injected on every request — priority access granted via CROSSREF_MAILTO email address, no API token requiredwithRetry: 3 attempts, exponential backoff, handles both 429 and 503 responseshas-abstract, has-references, from-pub-date); the server enforces correct syntax and surfaces API validation errors with actionable recovery hintsAdd the following to your MCP client configuration file. CROSSREF_MAILTO is optional but recommended — without it the server uses Crossref's anonymous pool with stricter rate limits.
{
"mcpServers": {
"crossref-mcp-server": {
"type": "stdio",
"command": "bunx",
"args": ["@cyanheads/crossref-mcp-server@latest"],
"env": {
"MCP_TRANSPORT_TYPE": "stdio",
"MCP_LOG_LEVEL": "info",
"CROSSREF_MAILTO": "[email protected]"
}
}
}
}Or with npx (no Bun required):
{
"mcpServers": {
"crossref-mcp-server": {
"type": "stdio",
"command": "npx",
"args": ["-y", "@cyanheads/crossref-mcp-server@latest"],
"env": {
"MCP_TRANSPORT_TYPE": "stdio",
"MCP_LOG_LEVEL": "info",
"CROSSREF_MAILTO": "[email protected]"
}
}
}
}Or with Docker:
{
"mcpServers": {
"crossref-mcp-server": {
"type": "stdio",
"command": "docker",
"args": [
"run", "-i", "--rm",
"-e", "MCP_TRANSPORT_TYPE=stdio",
"-e", "[email protected]",
"ghcr.io/cyanheads/crossref-mcp-server:latest"
]
}
}
}For Streamable HTTP, set the transport and start the server:
MCP_TRANSPORT_TYPE=http MCP_HTTP_PORT=3010 [email protected] bun run start:http
# Server listens at http://localhost:3010/mcpCROSSREF_MAILTO is optional but recommended — Crossref's polite pool grants priority access to clients that identify themselves. No account or token is required.git clone https://github.com/cyanheads/crossref-mcp-server.gitcd crossref-mcp-serverbun installcp .env.example .env
# edit .env and optionally set CROSSREF_MAILTO for polite-pool accessAll configuration is validated at startup via Zod schemas in src/config/server-config.ts.
| Variable | Description | Default |
|---|---|---|
CROSSREF_MAILTO | Email address embedded in the polite-pool User-Agent header. Optional — server starts without it but logs a warning and uses the anonymous pool with stricter rate limits. | — |
CROSSREF_BASE_URL | Crossref API base URL. Override for testing against a local proxy. | https://api.crossref.org |
CROSSREF_TIMEOUT_MS | Per-request timeout in milliseconds. | 10000 |
MCP_TRANSPORT_TYPE | Transport: stdio or http. | stdio |
MCP_HTTP_PORT | Port for the HTTP server. | 3010 |
MCP_AUTH_MODE | Auth mode: none, jwt, or oauth. | none |
MCP_LOG_LEVEL | Log level (RFC 5424). | info |
LOGS_DIR | Directory for log files (Node.js only). | <project-root>/logs |
OTEL_ENABLED | Enable OpenTelemetry instrumentation. | false |
See .env.example for the full list of optional overrides.
# One-time build
bun run rebuild
# Run the built server
bun run start:stdio
# or
bun run start:http bun run devcheck # Lint, format, typecheck, security
bun run test # Vitest test suite
bun run lint:mcp # Validate MCP definitions against spec| Directory | Purpose |
|---|---|
src/index.ts | createApp() entry point — registers tools and inits services. |
src/config | Server-specific environment variable parsing and validation with Zod. |
src/mcp-server/tools | Tool definitions (*.tool.ts). Five tools for Crossref data access. |
src/services/crossref | CrossrefService — HTTP client, polite-pool header, retry, pagination helpers. |
tests/ | Unit and integration tests mirroring src/. |
See CLAUDE.md for development guidelines and architectural rules. The short version:
try/catch in tool logicctx.log for request-scoped logging, ctx.state for tenant-scoped storagesrc/mcp-server/tools/definitions/index.tsIssues and pull requests are welcome. Run checks and tests before submitting:
bun run devcheck
bun run testApache-2.0 — see LICENSE for details.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.