---
summary: "crossref_get_work and crossref_get_references accept a resolver-wrapped DOI, sessions declare themselves stateless in src/, and the Crossref request URL no longer reaches callers in error.data."
breaking: false
security: true
---

# 0.3.13 — 2026-09-19

## Added

- **`crossref_get_work` and `crossref_get_references` accept a resolver-wrapped DOI** — `https://doi.org/…`, `https://dx.doi.org/…`, and `doi:…` are unwrapped to the bare DOI before the lookup, matching the funder-DOI path.
- **`createApp({ sessionMode: 'stateless' })` declares the HTTP session posture in `src/`** ([mcp-ts-core 0.13.1](https://github.com/cyanheads/mcp-ts-core/blob/main/changelog/0.13.x/0.13.1.md)) — no tool calls `ctx.requestInput`, so the posture no longer relies on `MCP_SESSION_MODE` being set at deploy time.
- **Hosted streamable-http endpoint registered in `server.json`** — `https://crossref.caseyjhand.com/mcp`.
- **`.github/workflows/codeql.yml`** ([mcp-ts-core 0.13.3](https://github.com/cyanheads/mcp-ts-core/blob/main/changelog/0.13.x/0.13.3.md)) — the one GitHub Actions workflow every server carries; CodeQL is GitHub-owned end to end.

## Changed

- **An argument rejection's `content[]` closes with a synthesized `Recovery:` line and `data.reason: "invalid_arguments"`**, matching the `InvalidParams` (-32602) envelope production clients already received ([mcp-ts-core 0.13.2](https://github.com/cyanheads/mcp-ts-core/blob/main/changelog/0.13.x/0.13.2.md), [0.13.3](https://github.com/cyanheads/mcp-ts-core/blob/main/changelog/0.13.x/0.13.3.md)).
- **`UPSTREAM_ERROR_CONTRACT`'s four entries carry `thrownBy: 'service'`** ([mcp-ts-core 0.13.6](https://github.com/cyanheads/mcp-ts-core/blob/main/changelog/0.13.x/0.13.6.md)) — lint-only metadata; `error-contract-unthrown` now skips reasons the service layer raises instead of the handler.
- `devcheck`'s Packaging step also gates the README version badge, and `scripts/build.ts` / `scripts/devcheck.ts` probe both the root and `config/` tsconfig layouts ([mcp-ts-core 0.13.2](https://github.com/cyanheads/mcp-ts-core/blob/main/changelog/0.13.x/0.13.2.md)).

## Fixed

- **`CrossrefService` no longer puts the Crossref request URL on client-facing `error.data`** — every throw site (HTML/empty/malformed body, transport failure, timeout, cancellation, HTTP error response) drops the `url` field, following the framework default `httpErrorFromResponse` now ships ([mcp-ts-core 0.13.4](https://github.com/cyanheads/mcp-ts-core/blob/main/changelog/0.13.x/0.13.4.md)). The URL is logged once per failed call through the Pino-only `logger` instead.

## Security

- **The upstream request URL is no longer forwarded to callers on any Crossref failure.** `CROSSREF_BASE_URL` is operator-configurable, so a deployment pointed at a private mirror previously handed that hostname, plus every query string this server built, to every caller on every failure.

## Dependencies

- `@cyanheads/mcp-ts-core` `^0.13.0` → `^0.13.6`
- `zod` `^4.6.1` → `^4.6.5`
- `@biomejs/biome` (dev) `^2.5.13` → `^2.5.14`
- `@types/node` (dev) `^26.5.1` → `^26.6.1`
- `tsc-alias` (dev) `^1.9.4` → `^1.9.5`
- `vitest` (dev) `^5.0.0` → `^5.0.1`

470 tests pass; `bun run devcheck`, `bun run lint:mcp`, and `bun run rebuild` clean.