VASTlint · Open-source · Apache 2.0 · IAB VAST 2.0–4.3
VAST Tag
Validator & Linter
VASTlint is an open-source VAST validation toolkit for ad tech teams. Use the VAST Tag Validator for pure XML compliance, the VAST Tag Tester for live URL fetches and creative preview, and the VAST Inspector for wrapper-chain debugging. The same Rust core ships as native Go, Erlang/Elixir, and npm libraries for runtime validation inside SSPs, DSPs, and ad servers, plus a CLI, VS Code extension, and an MCP server for AI agents.
Why trust this validator
Rules derived from published IAB specs, not guesswork
VASTlint is an independent open-source validator against the published IAB Tech Lab standards, not an official IAB Tech Lab tool. Where IAB publishes VAST XSD schemas, VASTlint derives machine-verifiable structural rules from those schemas. Where the spec uses RFC 2119 normative prose, VASTlint derives rules from that text. If you already run IAB XSD validation in CI, keep it as a baseline. VASTlint complements it with prose-derived, XML, URI, media-type, and operational checks built for production CTV, streaming, SSP, DSP, SSAI, and ad-server workflows.
Published IAB XSD schemas first
Where IAB Tech Lab publishes VAST XSD schemas, VASTlint derives machine-verifiable structural rules directly from those schemas.
RFC 2119 prose where schemas stop
When the VAST or SIMID specs use MUST, REQUIRED, SHALL, or SHOULD, VASTlint derives rules from that normative prose. That is especially important for SIMID and VAST 4.3, where no IAB XSD exists.
Baseline plus real-world rigor
Keep IAB XSD validation in CI if you already run it. VASTlint complements it with prose-derived, XML, URI, media-type, and operational checks, but player, SDK, exchange, and business rules can still matter.
Get VAST spec updates, platform guides, and release notes in your inbox.
Validate at scale
Built for realtime bidding pipelines
2,747 tags/sec on a single core. 15,760+ across 10 cores (17–44 KB production tags). Embed vastlint-core or the native Go, Erlang/Elixir, or npm bindings directly in your SSP, DSP, or ad server for runtime validation of every bid response, with zero network round-trips and sub-millisecond latency on typical tags.
Throughput / sec
15,760tags · single core
Error rate
0.0%0 rejected
Warning rate
0.0%0 flagged
Impressions
0.00M0 tags total
Top firing rules
warming up…VAST throughput / sec
15,760tags validated · single core
VAST error rate
0.0%0 VAST tags rejected
VAST warning rate
0.0%0 VAST tags flagged
VAST impressions seen
0.00M0 VAST tags total
invalid VAST impressions / hr
0.00M
0 tags rejected in-band
Bad tags caught before the bid is committed
at-risk VAST impressions / hr
0.00M
0 tags flagged with rule IDs
Partners get rule IDs, not silence
CTV ad revenue recovered / hr
$0.00
0.00M impressions served via fallback
Clean fallback tags serve in the same auction window
Without vastlint
✗ 0.00M impressions dropped✗ $0.00 unrecovered✗ Partners never notifiedAgentic advertising
AI agents are trafficking creative now. Validation needs to be in the loop.
The IAB Tech Lab’s AAMP protocol lets AI buyer and seller agents negotiate deals and place orders with no human approving each step. The VASTlint MCP server slots directly into that workflow: an agent calls validate_vast or validate_vast_url before confirming the deal, gets a structured pass/fail with rule IDs and XPath locations, and reject or escalate, no manual review needed.
TOOL CALL
validate_vast
Validate raw VAST XML inline. Returns errors, warnings, and advisories with rule IDs and spec refs.
validate_vast_url
Fetch and validate a live VAST URL, following wrapper chains up to 6 hops.
fix_vast
Auto-repair common issues (HTTP to HTTPS upgrades, deprecated attribute removal) and return corrected XML.
list_rules
Return the full catalog of validation rules with IDs, severities, and spec references.
explain_rule
Get the full definition and spec citation for a given rule ID.
Compatible with Claude, Cursor, Copilot, and any AAMP Buyer Agent SDK integration. Hosted at vastlint.org/mcp (no install required). Listed on the MCP Registry.
See it in action
Errors appear exactly where they are
Real validation runs in under a millisecond. Try it with your own VAST tag →
Why VAST validation matters
$30B in CTV ad spend runs on VAST tags. Most errors are invisible until revenue is gone.
40%
of VOD ads fail to render
Tag-level errors (missing fields, malformed URLs, bad duration formats) are a leading cause of delivery failure.
>25%
impression gap triggers investigation
Google Ad Manager flags a >25% gap between code served and impressions counted as a systemic issue.
6 versions
of the spec in active use
VAST 2.0 through 4.3 are all in production. A tag valid in 4.2 may use elements removed in 3.0.
Silent
failures leave no trace in logs
A VPAID tag on a VPAID-blocked platform produces no error. The slot goes dark. The discrepancy surfaces three days later.
What VASTlint checks
Spec-derived coverage across IAB VAST 2.0–4.3
Instant results
Paste a tag, get a structured report of errors, warnings, and advisories in under a millisecond.
Spec-derived checks
Rules are derived from published IAB VAST XSD schemas where available, RFC 2119 normative spec prose where schemas stop, and supporting standards such as W3C XML and RFC 3986.
VAST 2.0 – 4.3
All six IAB Tech Lab versions are supported. VAST 4.3 has no published XSD, so 4.3 rules are derived from the normative specification prose.
Privacy-first
Your tag is never stored. Validation runs in the request and nothing is logged or retained.
Auto-fix
vastlint fix repairs common issues and writes corrected XML back to the file. Use --dry-run to preview changes before applying.
Runtime validation in every stack
The same Rust core powers the CLI, Go module (CGo, no Rust toolchain), Erlang/Elixir NIF, WASM npm package, VS Code extension, and MCP server. Embed it for runtime validation in the serving path: realtime bid validation, creative monitoring, or CI.
Free and open-source
Apache 2.0 licensed. No account, no rate limits, no paywall.
MCP server for AI agents
Native MCP server at vastlint.org/mcp. Connect Claude, Cursor, Copilot, or any AAMP-compatible buyer agent. Call validate_vast before trafficking. Structured JSON result, no manual review needed.
Roadmap
Where we are and where we’re going
- Released
Core library, CLI & bindings
vastlint-core on crates.io, CLI via Homebrew/Cargo, JS/WASM on npm, Go and Erlang/Elixir packages on GitHub. Auto-fix repairs common issues in place with --dry-run, --out, and JSON report support.
- Released
Web validator & REST API
Paste or drop a VAST tag at vastlint.org/validate for an instant structured report. Authenticated /validate endpoint on RapidAPI for programmatic access.
- Released
Editor & browser extensions
VS Code and Open VSX extensions for inline validation as you type. Chrome extension detects VAST XML on any page and shows squiggly annotations and a WASM-powered panel.
- Released
Agentic workflows (MCP)
Native MCP server at vastlint.org/mcp. Supports Claude, Cursor, Copilot, and any AAMP-compatible agent. Tools: validate_vast, validate_vast_url, list_rules, explain_rule, fix_vast. Listed on the MCP Registry.
- Released
SIMID validation (1.0 – 1.2)
9 rules covering SIMID 1.0 linear and SIMID 1.1 nonlinear creatives: type attribute, HTTPS enforcement, URL presence, variableDuration value, MediaFile fallback, and IFrameResource for nonlinear.
- Current
OMID validation & more bindings
Expanded OMID semantic pass: vendor format, duplicate detection, HTTPS and apiFramework="omid" semantics, VerificationParameters guidance. Plus Erlang/Elixir packaging and Python, Ruby, Java wrappers.
- Planned
VMAP & DAAST validation
VMAP 1.0: AdBreak structure, timeOffset format, breakType enum, and pod constraints. DAAST 1.0: digital audio ad serving, structural sibling of VAST for audio-first creative types.
- Planned
IAB Content Taxonomy validation
Validate known authority URIs on <Category> and <BlockedAdCategories> elements against the IAB Content Taxonomy registry.
- Planned
Cloud deployment & pipeline monitoring
Deploy VASTlint as a private Lambda or container in your AWS account, so no data leaves your infrastructure. Continuous validation of live VAST traffic with per-partner error rates and revenue dashboards.
- Planned
What else?
Have a use case we haven’t covered? Tell us what you need →
Validate a VAST tag now
Free, instant, no account required.