VASTlint · Open-source · Apache 2.0 · IAB VAST 2.0–4.4
VAST Tag
Validator & Linter
VASTlint is an open-source VAST validation toolkit for ad tech teams. Use the VAST Tag Validator for pure XML compliance, the VAST Tag Tester for live URL fetches and creative preview, and the VAST Inspector for wrapper-chain debugging. For SIMID handshake, host transport, and a player-shaped studio, open the Next-Gen VAST Tester. The same Rust core ships as native Go, Python, Erlang/Elixir, and npm libraries for runtime validation inside SSPs, DSPs, and ad servers, plus a CLI, VS Code extension, and an MCP server for AI agents.
Why trust this validator
Rules derived from published IAB specs, not guesswork
VASTlint is an independent open-source validator against the published IAB Tech Lab standards, not an official IAB Tech Lab tool. Where IAB publishes VAST XSD schemas, VASTlint derives machine-verifiable structural rules from those schemas. Where the spec uses RFC 2119 normative prose, VASTlint derives rules from that text. If you already run IAB XSD validation in CI, keep it as a baseline. VASTlint complements it with prose-derived, XML, URI, media-type, and operational checks built for production CTV, streaming, SSP, DSP, SSAI, and ad-server workflows.
Published IAB XSD schemas first
Where IAB Tech Lab publishes VAST XSD schemas, VASTlint derives machine-verifiable structural rules directly from those schemas.
RFC 2119 prose where schemas stop
When the VAST or SIMID specs use MUST, REQUIRED, SHALL, or SHOULD, VASTlint derives rules from that normative prose. That is especially important for SIMID and VAST 4.3, where no IAB XSD exists.
Baseline plus real-world rigor
Keep IAB XSD validation in CI if you already run it. VASTlint complements it with prose-derived, XML, URI, media-type, and operational checks, but player, SDK, exchange, and business rules can still matter.
Get VAST spec updates, platform guides, and release notes in your inbox.
Validate at scale
Built for realtime bidding pipelines
2,747 tags/sec on a single core. 15,760+ across 10 cores (17–44 KB production tags). Embed vastlint-core or the native Go, Erlang/Elixir, or npm bindings directly in your SSP, DSP, or ad server for runtime validation of every bid response, with zero network round-trips and sub-millisecond latency on typical tags.
Throughput / sec
15,760tags · single core
Error rate
0.0%0 rejected
Warning rate
0.0%0 flagged
Impressions
0.00M0 tags total
Top firing rules
warming up…VAST throughput / sec
15,760tags validated · single core
VAST error rate
0.0%0 VAST tags rejected
VAST warning rate
0.0%0 VAST tags flagged
VAST impressions seen
0.00M0 VAST tags total
invalid VAST impressions / hr
0.00M
0 tags rejected in-band
Bad tags caught before the bid is committed
at-risk VAST impressions / hr
0.00M
0 tags flagged with rule IDs
Partners get rule IDs, not silence
CTV ad revenue recovered / hr
$0.00
0.00M impressions served via fallback
Clean fallback tags serve in the same auction window
Without vastlint
✗ 0.00M impressions dropped✗ $0.00 unrecovered✗ Partners never notifiedAgentic advertising
AI agents are trafficking creative now. Validation needs to be in the loop.
The IAB Tech Lab’s AAMP protocol lets AI buyer and seller agents negotiate deals and place orders with no human approving each step. The VASTlint MCP server slots directly into that workflow: an agent calls validate_vast or validate_vast_url before confirming the deal, gets a structured pass/fail with rule IDs and XPath locations, and reject or escalate, no manual review needed.
TOOL CALL
validate_vast
Validate raw VAST XML inline. Returns errors, warnings, and advisories with rule IDs and spec refs.
validate_vast_url
Fetch and validate a live VAST URL.
inspect_vast
Follow a wrapper chain hop-by-hop. Returns AdSystem, media files, and validation for every hop.
fix_vast
Auto-repair common issues (HTTP to HTTPS upgrades, deprecated attribute removal) and return corrected XML.
list_rules
Return the full catalog of validation rules with IDs, severities, and spec references.
explain_rule
Get the full definition and spec citation for a given rule ID.
Compatible with Claude, Cursor, Copilot, and any AAMP Buyer Agent SDK integration. Hosted at vastlint.org/mcp (no install required). Tags sent there may be stored; see privacy. Listed on the MCP Registry.
See it in action
Errors appear exactly where they are
Real validation runs in under a millisecond. Try it with your own VAST tag →
Why VAST validation matters
$30B in CTV ad spend runs on VAST tags. Most errors are invisible until revenue is gone.
40%
of VOD ads fail to render
Tag-level errors (missing fields, malformed URLs, bad duration formats) are a leading cause of delivery failure.
>25%
impression gap triggers investigation
Google Ad Manager flags a >25% gap between code served and impressions counted as a systemic issue.
6 versions
of the spec in active use
VAST 2.0 through 4.4 are all in production. A tag valid in 4.2 may use elements removed in 3.0.
Silent
failures leave no trace in logs
A VPAID tag on a VPAID-blocked platform produces no error. The slot goes dark. The discrepancy surfaces three days later.
What VASTlint checks
Spec-derived coverage across IAB VAST 2.0–4.4
Instant results
Paste a tag, get a structured report of errors, warnings, and advisories in under a millisecond.
Spec-derived checks
Rules are derived from published IAB VAST XSD schemas where available, RFC 2119 normative spec prose where schemas stop, and supporting standards such as W3C XML and RFC 3986.
VAST 2.0 – 4.3
All six IAB Tech Lab versions are supported. VAST 4.3 has no published XSD, so 4.3 rules are derived from the normative specification prose.
Open source
Apache 2.0. Validation runs in your browser. Tags you paste or fetch may be stored (IDs and IPs stripped) to improve the rules.
Auto-fix
vastlint fix repairs common issues and writes corrected XML back to the file. Use --dry-run to preview changes before applying.
Runtime validation in every stack
The same Rust core powers the CLI, Go module (CGo, no Rust toolchain), Python package (in-process FFI), Erlang/Elixir NIF, WASM npm package, VS Code extension, and MCP server. Embed it for runtime validation in the serving path: realtime bid validation, creative monitoring, or CI.
Free and open-source
Apache 2.0 licensed. No account, no rate limits, no paywall.
MCP server for AI agents
Native MCP server at vastlint.org/mcp. Connect Claude, Cursor, Copilot, or any AAMP-compatible buyer agent. Call validate_vast before trafficking. Tags sent to the hosted endpoint may be stored (IDs stripped). Local vastlint-mcp does not send tags.
Featured from the blog
Spec-Valid VAST Passes One Gate. CTV Ad Ops Now Runs Four Before Launch.
Ad ops · August 29, 2026 · 9 min read
Workshop polling on a nearly $30 billion CTV market put live-event forecasting and liveness signals ahead of creative approval. The readiness bar is structurally valid, environment-compatible, successfully executed, and observable, not XSD alone.
Roadmap
Where we are and where we’re going
- Released
Core library, CLI & bindings
vastlint-core on crates.io, CLI via Homebrew/Cargo, JS/WASM on npm, Go and Erlang/Elixir packages on GitHub. Auto-fix repairs common issues in place with --dry-run, --out, and JSON report support.
- Released
Web validator & REST API
Paste or drop a VAST tag at vastlint.org/validate for an instant structured report. Authenticated /validate endpoint on RapidAPI for programmatic access.
- Released
Editor & browser extensions
VS Code and Open VSX extensions for inline validation as you type. Chrome extension detects VAST XML on any page and shows squiggly annotations and a WASM-powered panel.
- Released
Agentic workflows (MCP)
Native MCP server at vastlint.org/mcp. Supports Claude, Cursor, Copilot, and any AAMP-compatible agent. Tools: validate_vast, validate_vast_url, inspect_vast, list_rules, explain_rule, fix_vast. Listed on the MCP Registry.
- Released
SIMID validation (1.0 – 1.2)
13 XML rules covering SIMID 1.0 linear and SIMID 1.1 nonlinear creatives: type, apiFramework casing, HTTPS, data: HTML MIME, variableDuration, MediaFile fallback, IFrameResource, interactiveStart, and SSAI-without-client. Creative fetch and handshake live in the VAST tester, not in default check or grpc.
- Released
VAST macro validation
Macro substitution tokens validated across tracking, click, error, impression, and media URLs: unknown [MACRO] detection, lowercase casing mistakes, deprecated tokens ([CONTENTPLAYHEAD]/[MEDIAPLAYHEAD] folded into [ADPLAYHEAD] at 4.1), context violations ([ERRORCODE] outside <Error>, [REASON] outside verificationNotExecuted), and missing percent-encoding. Full per-macro reference at vastlint.org/docs/vast-macros.
- Released
VMAP & DAAST validation
VMAP 1.0 (24 rules): AdBreak structure, timeOffset/breakType/repeatAfter formats, AdSource constraints, VMAP tracking events, and full VAST validation of inline VASTAdData. DAAST 1.0 (29 rules): audio-first deltas from VAST 3.0 including required Category, DAASTAdTagURI wrappers, AdInteractions, audio MediaFile attributes, and DAAST tracking/pricing.
- Released
OMID validation & language bindings
AdVerifications checks: vendor format, duplicates, HTTPS, apiFramework="omid", VerificationParameters, and pre-4.1 compatibility blocks. Python on PyPI, Ruby on RubyGems, Elixir/Erlang on hex.pm, Go and Java gRPC client on GitHub. Same vastlint-core.
- Released
IAB Content Taxonomy validation
authority on Category and BlockedAdCategories checked against IAB registry hosts. Custom taxonomies stay legal: unknown authorities are info, malformed ones are warnings.
- Released
gRPC sidecar & partner tallies
vastlint-grpc serves the catalog over openadtech.vastlint.v1. Prometheus counters on /metrics labelled by caller. Grafana JSON and a compose profile in deploy/pipeline/. XML is not stored.
- Planned
AWS Marketplace
Private Lambda or container in your AWS account. No VAST tag content leaves your infrastructure.
- Planned
What else?
Have a use case we haven’t covered? Tell us what you need →
Validate a VAST tag now
Free, instant, no account required.