VASTlint
Validate

AdCP conformance testing

An AdCP agent declares what it supports in its get_adcp_capabilities response. That declaration is a claim, not a credential. Conformance is decided separately, by running storyboards against the live endpoint and checking every response against the protocol's own JSON Schemas.

This page covers how that grading works, how to run it against your own agent, and how vastlint scores. If you are looking for what AdCP is and where it hands off to video creative, start with AdCP and VAST.

Storyboards, not self-declaration

A storyboard is a scripted sequence of tool calls, each with a response-schema assertion and often a cross-step invariant. They come in three layers:

  • Universal, which every agent must pass: capability discovery, error handling, pagination integrity, idempotency, security baseline, version negotiation.
  • Protocol, for any agent claiming a protocol such as media-buy, creative, signals, or governance.
  • Specialism, opt-in narrower claims such as content-standards or sales-guaranteed.

The runner reads your capability response and selects the storyboards your declarations obligate. Claiming more surface means being graded on more of it, so an accurate declaration is the first thing the suite checks.

{
  "supported_protocols": ["governance"],
  "specialisms": ["content-standards"],
  "adcp": {
    "major_versions": [3],
    "supported_versions": ["3.1"]
  }
}

Running the suite against your own agent

The @adcp/sdk package ships the runner as a CLI. It reports per-step pass, fail, or skip, and on failure prints the assertion, the expected schema, and the actual response.

# Run every storyboard your agent's declarations obligate
npx @adcp/sdk@latest storyboard run https://your-agent.example.com/mcp \
  --test-kit dist/compliance/3.1.1/test-kits/acme-outdoor.yaml

# See which storyboards a specialism resolves to, before running anything
npx @adcp/sdk@latest storyboard show --specialism content-standards

Two things are easy to get wrong here. The --test-kit flag is required for the security baseline to grade at all, because the authentication phases skip themselves when no kit supplies a credential, and the storyboard then fails on "no auth mechanism verified" even though nothing is wrong with your auth. It is also absent from the CLI's own help output. Separately, runs against http://localhost need --allow-http and are stamped as not publishable, so a result you intend to cite has to come from an HTTPS endpoint.

What the content-standards specialism checks

Content standards are the governance surface for creative quality: rules a buyer defines once, then applies before and after delivery. The specialism grades the whole lifecycle.

  • create_content_standards and list_content_standards, defining and querying a policy set scoped by brand, geography, channel, and language.
  • calibrate_content, the pre-flight check that runs sample creative against the standards before a campaign launches, including the case where content violates a must rule.
  • update_content_standards followed by re-calibration, so tightening a rule demonstrably changes the verdict.
  • validate_content_delivery, the after-the-fact check that delivered creatives met the standards they were bought under.

The intended implementers, per the specialism definition, are creative quality platforms, brand safety services, and ad verification tools. It answers "did this creative meet the policy", which is a different question from whether an agent was authorised to run the campaign at all.

How vastlint scores

vastlint is registered as an AdCP governance agent claiming the content-standards specialism. Against the AdCP 3.1.1 compliance bundle, the conformance deployment passes 28 steps with 0 failures: Core Protocol 34 of 34 scenarios, Governance 8 of 8.

The conformance endpoint is https://compliance.vastlint.org/mcp. It is a separate deployment from the production MCP server at https://vastlint.org/mcp, because the security baseline authenticates with credentials published in the spec's own test kits, and those belong nowhere near a production surface. Both run identical code.

Worth being precise about what this does and does not certify. It grades the wire contract: task shapes, error semantics, schema conformance, pagination and idempotency behaviour, authentication. It says nothing about how good the underlying VAST validation is. That is what the rule catalog is for. A passing agent is a legible one, not necessarily a useful one, and the two claims are worth keeping separate.

Why bother

Agentic buying stacks select tools by declared protocol and specialism. A conformance result turns "we speak AdCP" from an assertion into something a counterparty can verify without trusting you, which is the entire point of grading it externally.

It also finds things. Running the suite against vastlint surfaced real defects that no amount of local testing had: unauthenticated calls answered with HTTP 200 and an error body where the baseline requires a 401, a capability filter that emitted an empty array its own schema forbade, and a scope value outside the channel enum that was accepted on write and then broke every subsequent read for that brand. All of them were invisible until something independent checked.

Related