---
summary: "crossref_get_references returns structured empty data instead of throwing; ISSN and funder_doi validated at the tool boundary; CROSSREF_TIMEOUT_MS now enforced per-request"
breaking: false
security: false
---

# 0.1.13 — 2026-06-04

## Changed

- **`crossref_get_references`** no longer throws `no_references` when a DOI resolves but has no indexed reference list ([#22](https://github.com/cyanheads/crossref-mcp-server/issues/22)). Handler returns `{ doi, referenceCount: 0, references: [] }` and calls `ctx.enrich.notice()` with publisher coverage context. `no_references` error contract entry removed; `doi_not_found` remains for unresolvable DOIs.
- **`CrossrefService.request()`** now composes `AbortSignal.timeout(timeoutMs)` with `ctx.signal` via `AbortSignal.any()` on every upstream fetch ([#23](https://github.com/cyanheads/crossref-mcp-server/issues/23)). `CROSSREF_TIMEOUT_MS` is no longer a no-op.
- **`normalizeFunderId`** regex updated to strip `https://doi.org/` in addition to `https://dx.doi.org/` — aligns with the `funder_doi` Zod validator.

## Fixed

- **`crossref_search_journals` `issn`** Zod field now validates format via `.regex(/^\d{4}-?\d{3}[\dX]$/i)` ([#25](https://github.com/cyanheads/crossref-mcp-server/issues/25)). Malformed ISSNs fail at the tool boundary with `ValidationError` and a clear message; the pattern surfaces in JSON Schema.
- **`crossref_search_funders` `funder_doi`** Zod field now validates via `.regex(/^(?:https?:\/\/(?:dx\.)?doi\.org\/|doi:)?10\.13039\/\d+$/i)` ([#25](https://github.com/cyanheads/crossref-mcp-server/issues/25)). Accepts bare `10.13039/…`, `doi:` prefixed, and URL-prefixed forms; rejects non-funder-registry DOIs before any upstream call.