vastlint · Open-source · Apache 2.0 · IAB VAST 2.0–4.3
VAST XML
Validator & Linter
Embed the Rust core directly in your SSP, DSP, or ad server — sub-millisecond VAST XML validation at bid time, zero runtime dependencies. Go and Elixir/Erlang bindings ship prebuilt, no Rust toolchain needed. Also available as an MCP server for AI agents and AAMP buyer agents, a WASM npm package, VS Code extension, and an online validator.
Validate at scale
Built for realtime bidding pipelines
2,747 tags/sec on a single core. 15,760+ across 10 cores (17–44 KB production tags). Embed vastlint-core directly in your SSP, DSP, or ad server and validate every bid response inline, with zero network round-trips and sub-millisecond latency on typical tags.
Throughput / sec
14,200tags · single core
Error rate
0.0%0 rejected
Warning rate
0.0%0 flagged
Impressions
0.00M0 tags total
Top firing rules
warming up…VAST throughput / sec
14,200tags validated · single core
VAST error rate
0.0%0 VAST tags rejected
VAST warning rate
0.0%0 VAST tags flagged
VAST impressions seen
0.00M0 VAST tags total
invalid VAST impressions / hr
0.00M
0 tags rejected in-band
Bad tags caught before the bid is committed
at-risk VAST impressions / hr
0.00M
0 tags flagged with rule IDs
Partners get rule IDs, not silence
CTV ad revenue recovered / hr
$0.00
0.00M impressions served via fallback
Clean fallback tags serve in the same auction window
Without vastlint
✗ 0.00M impressions dropped✗ $0.00 unrecovered✗ Partners never notifiedAgentic advertising
AI agents are trafficking creative now. Validation needs to be in the loop.
The IAB Tech Lab’s AAMP protocol lets AI buyer and seller agents negotiate deals and place orders with no human approving each step. The vastlint MCP server slots directly into that workflow: an agent calls validate_vast or validate_vast_url before confirming the deal, gets a structured pass/fail with rule IDs and XPath locations, and reject or escalate, no manual review needed.
TOOL CALL
validate_vast
Validate raw VAST XML inline. Returns errors, warnings, and advisories with rule IDs and spec refs.
validate_vast_url
Fetch and validate a live VAST URL, following wrapper chains up to the IAB-recommended depth of 5.
fix_vast
Auto-repair common issues (HTTP to HTTPS upgrades, deprecated attribute removal) and return corrected XML.
Compatible with Claude, Cursor, Copilot, and any AAMP Buyer Agent SDK integration. Hosted at vastlint.org/mcp (no install required). Listed on the MCP Registry.
See it in action
Errors appear exactly where they are
Real validation runs in under a millisecond. Try it with your own VAST tag →
Why VAST validation matters
$30B in CTV ad spend runs on VAST XML. Most errors are invisible until revenue is gone.
40%
of VOD ads fail to render
Tag-level errors (missing fields, malformed URLs, bad duration formats) are a leading cause of delivery failure.
>25%
impression gap triggers investigation
Google Ad Manager flags a >25% gap between code served and impressions counted as a systemic issue.
6 versions
of the spec in active use
VAST 2.0 through 4.3 are all in production. A tag valid in 4.2 may use elements removed in 3.0.
Silent
failures leave no trace in logs
A VPAID tag on a VPAID-blocked platform produces no error. The slot goes dark. The discrepancy surfaces three days later.
What vastlint checks
118 rules derived directly from the IAB spec
Instant results
Paste a tag, get a structured report of errors, warnings, and advisories in under a millisecond.
118 rules
Required fields, malformed URLs, deprecated elements, VPAID, SIMID, skipoffset, duplicate impressions, and more.
VAST 2.0 – 4.3
All six IAB Tech Lab versions are supported. Rules are derived directly from published specs and XSD schemas.
Privacy-first
Your XML is never stored. Validation runs in the request and nothing is logged or retained.
Auto-fix
vastlint fix repairs common issues and writes corrected XML back to the file. Use --dry-run to preview changes before applying.
Native libraries for every stack
The same Rust core powers the CLI, Go module (CGo, no Rust toolchain), Elixir/Erlang NIF, WASM npm package, VS Code extension, and MCP server. Drop it into any pipeline — realtime bid validation, creative monitoring, or CI.
Free and open-source
Apache 2.0 licensed. No account, no rate limits, no paywall.
MCP server for AI agents
Native MCP server at vastlint.org/mcp. Connect Claude, Cursor, or any AAMP-compatible buyer agent. Call validate_vast before trafficking. Structured JSON result, no manual review needed.
Roadmap
Where we are and where we’re going
- Released
Core library published
vastlint-core v0.4.0 on crates.io. Zero-dependency Rust library, 118 rules across VAST 2.0–4.3 and SIMID 1.0–1.2.
- Released
CLI published
vastlint v0.4.0 on crates.io and Homebrew tap. JS/WASM on npm, Go and Erlang/Elixir bindings on GitHub.
- Released
Auto-fix
vastlint fix repairs common issues and writes corrected XML in place. Supports --dry-run, --out, stdin→stdout, and JSON fix reports.
- Released
Web validator
Paste or drop a VAST tag at vastlint.org/validate, get a structured report instantly.
- Released
VS Code extension
Inline VAST XML validation as you type. Errors and warnings with rule IDs and spec refs, directly in your editor.
- Released
REST API
Authenticated /validate endpoint on RapidAPI. Same 118 rules, WASM-powered, sub-millisecond response.
- Released
Agentic workflows (MCP)
Native MCP server at vastlint.org/mcp. Supports Claude, Cursor, and any MCP-compatible agent including the AAMP Buyer Agent SDK. Tools: validate_vast, validate_vast_url, list_rules, explain_rule, fix_vast. Returns structured pass/fail with rule IDs and XPath locations. Listed on the MCP Registry.
- Released
Chrome extension
The VAST Lint Chrome extension is live on the Chrome Web Store. Detects VAST XML on any page and shows inline squiggly annotations, hover tooltips, and a collapsible panel powered by the vastlint WASM core.
- Released
Language bindings
Go and Erlang/Elixir bindings shipped, backed by the same vastlint-core via FFI. Python, Ruby, and Java bindings in progress.
- Released
SIMID validation (1.0 – 1.2)
9 rules covering SIMID 1.0 linear and SIMID 1.1 nonlinear creatives: type attribute, HTTPS enforcement, URL presence, variableDuration value, MediaFile fallback, and IFrameResource for nonlinear. The IAB-sanctioned VPAID replacement is now fully validated.
- Planned
OMID validation
Validate <AdVerifications><Verification> blocks: vendor attribute format, HTTPS on JavaScriptResource, apiFramework casing, and duplicate vendor detection.
- Planned
VMAP 1.0 validation
Validate VMAP ad break schedule documents that wrap VAST tags: AdBreak structure, timeOffset format, breakType enum, and pod constraints.
- Planned
DAAST 1.0 validation
Digital audio ad serving. Structural sibling of VAST for audio-first creative types.
- Planned
IAB Content Taxonomy authority validation
Validate known authority URIs on <Category> and <BlockedAdCategories> elements against the IAB Content Taxonomy registry.
- Planned
AWS Marketplace
Deploy vastlint as a private Lambda or container in your own AWS account. No data leaves your infrastructure.
- Planned
Realtime pipeline integration
Continuous validation of live VAST traffic: per-partner error rates, alerting, and revenue dashboards.
- Planned
What else?
Have a use case we haven’t covered? Tell us what you need →
Validate a VAST tag now
Free, instant, no account required.