Product roadmap

This page tracks what vastlint has shipped, what's actively being built, and what's planned next. It is a product roadmap for current users and contributors, not a VAST troubleshooting page. The roadmap is maintained in the ROADMAP.md file in the repository. Requests and discussion welcome in GitHub Discussions.

Shipped

Core library

vastlint-core on crates.io. Zero-dependency, zero-I/O Rust library. Spec-derived validation for IAB VAST 2.0–4.4, plus shipped SIMID support and foundational OMID AdVerification checks. Validates in under a millisecond on typical production tags. Sub-microsecond on small tags.

CLI

vastlint on crates.io and the Homebrew tap. Install with brew install aleksUIX/tap/vastlint or cargo install vastlint. Supports single-file, glob, stdin, and vastlint fix auto-repair with --dry-run, --out, and JSON fix reports.

Web validator

Paste or drop a VAST tag at vastlint.org/validate and get a structured report instantly. Powered by the WASM build of vastlint-core. Validation runs in the browser. Tags you paste or fetch may be stored (IDs and IPs stripped) to improve the rules and for research described in the terms; see the privacy page.

VS Code extension

Inline VAST XML validation as you type. Errors and warnings appear with rule IDs and spec references directly in the editor gutter. Install from the VS Code Marketplace.

Chrome extension

The VASTlint Chrome extension is live on the Chrome Web Store. It detects VAST XML on any page and overlays inline squiggles, hover tooltips, and a collapsible validation panel powered by the same WASM core used on vastlint.org.

REST API

Authenticated /validate endpoint available on RapidAPI. Same spec-derived checks, WASM-powered, sub-millisecond response. Drop-in for CI pipelines and ad server integrations that can't embed the native library.

Agentic workflows (MCP)

Native MCP server at vastlint.org/mcp. Connect Claude, Cursor, or any MCP-compatible agent to vastlint. Tools available: validate_vast, validate_vast_url, inspect_vast, list_rules, explain_rule, and fix_vast. Listed on the MCP Registry.

Go bindings

Go bindings shipped at vastlint-go. One validation engine, every language: the binding is backed by the same vastlint-core via FFI.

SIMID validation

SIMID 1.0–1.2 XML validation is shipped in the public validator and the shared core. The catalog covers InteractiveCreativeFile typing, exact apiFramework casing, HTTPS (including javascript: and file:), data: HTML MIME, variableDuration, MediaFile fallback, nonlinear IFrameResource placement, interactiveStart on VAST 4.2+, and SSAI-without-client. vastlint fix repairs the one-legal-form XML defects. The validator does not GET the creative HTML or run the postMessage handshake.

VAST macro validation

Macro substitution tokens ([CACHEBUSTING], [ADPLAYHEAD], [ERRORCODE], and the rest) are validated across tracking, click, error, impression, and media URLs: unknown macro detection, lowercase casing mistakes, deprecated tokens ([CONTENTPLAYHEAD] and [MEDIAPLAYHEAD] folded into [ADPLAYHEAD] at VAST 4.1), context violations ([ERRORCODE] outside <Error>, [REASON] outside verificationNotExecuted), and missing percent-encoding. The full per-macro reference, with the value each one resolves to and where it is valid, lives at vastlint.org/docs/vast-macros.

gRPC sidecar

vastlint-grpc serves the same catalog over openadtech.vastlint.v1. JVM ad servers call it through vastlint-java. Docs: vastlint-grpc.

Partner tallies

Every Validate and ValidateStream verdict increments Prometheus counters on /metrics, labelled by x-vastlint-caller (seat, DSP, AdSystem). Findings include the same $ revenue-impact flag the CLI prints. Grafana JSON and docker compose --profile pipeline live in deploy/pipeline/. The XML is not stored.

OMID, VMAP, DAAST, language bindings

OMID <AdVerifications> checks, VMAP 1.0, DAAST 1.0, and IAB Content Taxonomy authority validation are in the core catalog. Language bindings ship for Go, Python, Ruby, Elixir/Erlang, and Java (gRPC client).

Upcoming

SIMID creative QA in the VAST tester

XML-clean SIMID tags still fail in-player when the URL is a JavaScript file, the origin sends X-Frame-Options: DENY, or the page never posts createSession. That fetch and (later) handshake belongs in the VAST tester, not in vastlint-core, default check, RapidAPI, or grpc. Desktop Chromium is not a Roku webview. The tester will not stamp SIMID certified.

AWS Marketplace

Deploy vastlint as a private Lambda or container in your own AWS account. No VAST tag content leaves your infrastructure. Suitable for SSPs and DSPs with data residency requirements.

Have a use case we haven't covered?

Open a discussion on GitHub Discussions or file a feature request issue. The roadmap is driven by real production use cases. If something is blocking you, say so.