VASTlint

Website & web validator: VAST tag validator Paste a VAST tag and get results in your browser, no install required.

A high-performance VAST XML validator built on a pure-Rust core. Checks ad tags against the IAB Tech Lab VAST specification so you don't have to read it. Over $30 billion in annual CTV and video ad spend flows through VAST XML, and malformed tags are one of the most common causes of lost impressions, broken tracking, and revenue discrepancies between platforms. There is no widely adopted open-source tool that validates VAST XML against the full IAB specification across all published versions.

VASTlint ships a native MCP server - making VAST validation available as a callable tool from Claude, Cursor, the AAMP Buyer Agent SDK, or any MCP-compatible client. Connect to vastlint.org/mcp and call validate_vast, validate_vast_url, inspect_vast, list_rules, explain_rule, or fix_vast. Each tool returns structured JSON with rule IDs, XPath locations, and spec references.

Native bindings for realtime ad pipelines: vastlint-go (CGo, prebuilt static libs, no Rust toolchain needed), vastlint-java (gRPC client for JVM ad servers), vastlint-erlang (Elixir/Erlang: OTP port mode for production ad delivery, DirtyCpu NIF for non-critical paths), and a WASM npm package for Node.js and browsers. All bindings share the same compiled Rust core. Consistent results everywhere, sub-millisecond latency at scale.

Need a copy-paste frontend starting point? See the React drop-in example in npm/examples.

Validates VAST documents against:

• IAB Tech Lab VAST 2.0, 3.0, 4.0, 4.1, 4.2, and 4.3 — structural rules derived from the published XSD schemas (W3C REC-xmlschema-1) and spec prose (RFC 2119 normative key words)
• W3C XML 1.0 well-formedness — malformed documents are rejected before any spec rule runs
• RFC 3986 URI syntax — all URL fields
• IANA Media Types — MIME types on MediaFile, InteractiveCreativeFile, Mezzanine, and ClosedCaptionFile
• ISO 4217 currency codes — Pricing elements
• Ad-ID registry format — UniversalAdId
• IAB Tech Lab SIMID 1.0, 1.0.1, 1.1, 1.2 — XML envelope for <InteractiveCreativeFile apiFramework="SIMID"> and nonlinear <IFrameResource> (the IAB-sanctioned VPAID replacement). Creative fetch, frame headers, and the postMessage handshake live in the VAST tester, not in vastlint-core or default check.
• IAB Tech Lab OMID / Open Measurement compatibility in VAST <AdVerifications> — vendor format, duplicate vendor detection, OMID resource semantics, verification tracking validation, and pre-4.1 extension-carried compatibility blocks

234 rules across required fields, schema validation, structural correctness, security, consistency, deprecated features, ambiguous usage, value formats, SIMID validation, OMID validation, VMAP 1.0, and DAAST 1.0. Rules marked with $ have direct revenue impact - use vastlint check --fail-on-warning in CI to catch them before they reach production. See common errors for the ones that cost real money. New to VASTlint? Start with the tutorial.

Full rule reference with examples and fix instructions: VAST error rule reference · RULES.md

How rules are derived: Rule derivation methodology · METHODOLOGY.md

For adjacent checks, RTBlint validates OpenRTB bid requests and responses. Pixellint validates pixels, postbacks, tracking URLs, and conversion API payloads.

Enterprise readiness

Zero runtime dependencies in the core. vastlint-core has three compile-time dependencies (quick-xml, url, phf) and no runtime dependencies whatsoever — no async runtime, no regex engine, no schema interpreter. Rules are compiled Rust functions. There is no transitive dependency graph to audit, no CVE surface to track, and no supply chain to compromise at runtime.

Verifiable build provenance. All release artifacts are signed with SLSA Build Level 2 provenance via GitHub's native attestation store. Every binary, library, .vsix, and npm package can be verified cryptographically against the exact source commit that produced it. No developer machine is ever involved in producing release artifacts. SLSA L3 (hermetic, isolated signing) is in progress.

No data retention by default — and full self-hosting available. The VS Code extension and Chrome page-scan path process XML locally. Pasting a tag in the Chrome popup opens the hosted tester; that path follows the website policy. The CLI does not send tags unless you pass --contribute-sample. The hosted tester, inspector, validator, and MCP server at vastlint.org/mcp may store a redacted copy of tags you submit, so the rules can be improved; see vastlint.org/privacy. Local vastlint-mcp over stdio does not send tags. The RapidAPI /validate API and the gRPC sidecar still validate ephemerally. See Telemetry and sample contribution and PRIVACY.md for the Chrome extension policy.

For teams that require on-premise processing or air-gapped deployments, VASTlint runs entirely self-hosted: the CLI image (FROM scratch, under 5 MB, cold-start under 10 ms), the vastlint-grpc sidecar (aleksuix/vastlint-grpc:0.13.2), or the pre-built static musl binary. The Rust core has no network code: no callbacks, no telemetry, no license checks. The sidecar exposes partner tallies on /metrics (port 9090); scrape them yourself.

Apache 2.0 licensed. No CLA, no dual-license commercial upsell, no usage-based restrictions. Fork it, vendor it, embed it, redistribute it.

Dependency update automation. Dependabot monitors Cargo, npm, and GitHub Actions dependencies weekly and opens PRs automatically. Combined with cargo audit on every CI push and CodeQL static analysis on every push and PR, the dependency surface stays current without manual tracking.

Auditable. OpenSSF Scorecard runs weekly and publishes a public score. CII Best Practices badge covers vulnerability reporting, CI, fuzzing, and code review requirements. The Security Advisory channel provides a private disclosure path with a 48-hour acknowledgement SLA.

Fuzz-tested continuously. Three libFuzzer targets run on every CI push against the core validator and auto-fix engine. See the Fuzzing section below.

Performance

Benchmarked on Apple M4 (10-core), production-realistic VAST tags (17–44 KB):

Metric	17 KB tag	44 KB tag
Single-thread throughput	2,747 tags/sec	475 tags/sec
Single-thread latency	363 µs	2,104 µs
10-core throughput	15,760 tags/sec	2,635 tags/sec

A typical OpenRTB bid cycle takes 100–300 ms; validation adds less than 2.1% of that budget even on the heaviest tags. An SSAI pipeline doing 1,000 stitches/sec spends more time on DNS than on validating the VAST response.

No async runtime, no regex engine, no schema interpreter. Rules are compiled Rust functions. Three dependencies: quick-xml, url, and phf (compile-time hash maps).

Install

cargo install vastlint

CLI crate on crates.io: crates.io/crates/vastlint

Or download a pre-built binary from the releases page.

Docker

Pull the image from Docker Hub:

docker pull aleksuix/vastlint

Validate a file:

docker run --rm -v "$(pwd)":/data aleksuix/vastlint check /data/tag.xml

Pipe from stdin:

cat tag.xml | docker run --rm -i aleksuix/vastlint check -

JSON output:

docker run --rm -v "$(pwd)":/data aleksuix/vastlint check /data/tag.xml --format json

Validate a whole directory:

docker run --rm -v "$(pwd)/tags":/data aleksuix/vastlint check /data/*.xml

The image is built FROM scratch - a fully-static musl binary with no OS layer. Compressed size is under 5 MB. Cold-start to first result is under 10 ms.

Usage

# validate a file
vastlint check tag.xml

# validate multiple files
vastlint check *.xml

# read from stdin
cat tag.xml | vastlint check -

# JSON output (one object per file, newline-delimited)
vastlint check tag.xml --format json

# suppress colours
vastlint check tag.xml --no-color

# exit 0 even on errors (useful in some CI setups)
vastlint check tag.xml --no-fail

# opt in to anonymous usage telemetry (see Telemetry section below)
vastlint check tag.xml --telemetry

# override the VAST version used for validation (ignores the version= attribute)
vastlint check tag.xml --vast-version 4.2

# replace template macros before validation so URL rules don't fire on placeholders
vastlint check tag.xml --ignore-pattern '\$\{[^}]+\}|%%[^%]+%%'

# upload the report and print a shareable link (vastlint.org/r/<id>) — sends
# the validation result only (rule IDs, severities, XPath), never the raw XML
vastlint check tag.xml --share

# list all rules with default severity
vastlint rules

# automatically fix common issues and overwrite the file
vastlint fix tag.xml

# fix and write to a new path instead of overwriting
vastlint fix tag.xml --out tag-fixed.xml

# preview what would change without writing anything
vastlint fix tag.xml --dry-run

# fix from stdin, repaired XML goes to stdout
cat tag.xml | vastlint fix -

Example output:

tag.xml  VAST 4.2
  error    <Duration> value does not match required format HH:MM:SS or HH:MM:SS.mmm  VAST-2.0-duration-format
           /VAST/Ad[0]/InLine/Creatives/Creative[0]/Linear/Duration
  error    <MediaFile> delivery attribute must be "progressive" or "streaming"  VAST-2.0-mediafile-delivery-enum
           /VAST/Ad[0]/InLine/Creatives/Creative[0]/Linear/MediaFiles/MediaFile[0][@delivery]
  info     <MediaFiles> has no <Mezzanine> - ad-stitching servers may reject this tag  VAST-4.1-mezzanine-recommended
           /VAST/Ad[0]/InLine/Creatives/Creative[0]/Linear/MediaFiles

✖ 2 errors, 0 warnings, 1 info

Auto-fix ⚠️ experimental

vastlint fix is opinionated and experimental. It applies a small set of deterministic, low-risk repairs (HTTPS upgrades including SIMID HTTP://, SIMID apiFramework / variableDuration / missing type="text/html", conditionalAd removal). Always review the diff before committing. Use --dry-run first, and re-run check afterward to confirm the result. Future releases may make individual fixes configurable.

vastlint fix repairs fixable issues and writes the corrected XML back to the file (or to a separate path with --out):

# preview changes without writing (recommended first step)
vastlint fix tag.xml --dry-run

# overwrite the file in place
vastlint fix tag.xml

# write to a new file instead of overwriting
vastlint fix tag.xml --out tag-fixed.xml

# JSON report of what was fixed
vastlint fix tag.xml --format json

# pipe from stdin → repaired XML to stdout
cat tag.xml | vastlint fix -

Not every rule is auto-fixable - some require human judgment (e.g. choosing the right <AdSystem> value). After running fix, re-run check to confirm the remaining issues.

Exit codes

Code	Meaning
0	All files valid - no errors found
1	One or more files have validation errors
2	Usage error - unreadable file, bad config, or bad arguments

Config file

Create vastlint.toml anywhere in your project tree. vastlint searches up from the current directory and uses the first one it finds. vastlint init generates a starter file with every rule listed at its default severity, commented out:

$ vastlint init
wrote vastlint.toml (234 rules, all commented out at defaults)

[rules]
"VAST-2.0-mediafile-https" = "off"
"VAST-4.1-vpaid-apiframework" = "warning"

Valid levels: error, warning, info, off.

Use --config <path> to specify a config file explicitly, or --no-config to ignore all config files.

CI

# .github/workflows/vast-lint.yml
- name: Install vastlint
  run: cargo install vastlint

- name: Validate VAST tags
  run: vastlint check tags/**/*.xml

Or download a release binary instead of building from source:

- name: Install vastlint
  run: |
    curl -sL https://github.com/aleksUIX/vastlint/releases/latest/download/vastlint-x86_64-linux-musl.tar.gz \
      | tar xz -C /usr/local/bin

- name: Validate VAST tags
  run: vastlint check tags/**/*.xml

JSON output

--format json emits one JSON object per file, one per line (NDJSON). This makes it easy to process output with jq or pipe it into other tools.

{"file":"tag.xml","version":"4.2","valid":false,"summary":{"errors":1,"warnings":2,"infos":0},"issues":[{"id":"VAST-2.0-inline-adsystem","severity":"error","message":"<InLine> must contain <AdSystem>","path":"/VAST/Ad[0]/InLine","spec_ref":"IAB VAST 2.0 §2.2.1"}]}

Fields:

Field	Type	Description
file	string	Path as given on the command line, or "-" for stdin
version	string	Detected VAST version, or "unknown"
valid	bool	True when there are zero errors
summary.errors	number	Count of error-level issues
summary.warnings	number	Count of warning-level issues
summary.infos	number	Count of info-level issues
issues[].id	string	Rule ID (stable, use in config to override)
issues[].severity	string	"error", "warning", or "info"
issues[].message	string	Human-readable description
issues[].path	string	XPath-style location in the document
issues[].spec_ref	string	Section of the IAB VAST spec

Use as a library

vastlint-core is published separately as a library crate. Full API documentation is on docs.rs.

[dependencies]
vastlint-core = "0.11"

use vastlint_core::validate;

let result = validate(xml_string);
if result.summary.is_valid() {
    println!("valid");
} else {
    for issue in &result.issues {
        println!("{}: {}", issue.id, issue.message);
    }
}

To override rule levels programmatically:

use std::collections::HashMap;
use vastlint_core::{validate_with_context, RuleLevel, ValidationContext};

let mut overrides = HashMap::new();
overrides.insert("VAST-2.0-mediafile-https", RuleLevel::Off);

let ctx = ValidationContext {
    rule_overrides: Some(overrides),
    ..Default::default()
};

let result = validate_with_context(xml_string, ctx);

Embed in your ad server (SSP, DSP, SSAI)

The primary use case for VASTlint is in-process validation inside ad tech infrastructure — embed vastlint-core directly in your bid handler or SSAI stitcher to validate every VAST response before committing the impression. No subprocess, no network round-trip.

A typical OpenRTB bid cycle has 100–300 ms to work with; VASTlint adds less than 2.1% of that budget even on the heaviest 44 KB production tags. An SSAI platform doing 1,000 stitches/sec spends more time on DNS than on VAST validation.

Rust — vastlint-core (pure Rust, three small dependencies):

use vastlint_core::{validate_with_context, ValidationContext};

let ctx = ValidationContext::default();
let result = validate_with_context(vast_xml, ctx);

if !result.summary.is_valid() {
    // Reject the bid. Return rule IDs to the partner for remediation.
    for issue in result.issues.iter().filter(|i| i.severity == "error") {
        log::warn!("VAST rejected: {} at {}", issue.id, issue.path);
    }
}

Go — vastlint-go (no Rust toolchain required, prebuilt static libs):

import vastlint "github.com/aleksUIX/vastlint-go"

result, err := vastlint.ValidateWithOptions(xmlBytes, vastlint.Options{
    MaxWrapperDepth: 5,
    RuleOverrides: map[string]string{
        "VAST-4.1-mezzanine-recommended": "off", // relax CTV-only rule for web inventory
    },
})
if err != nil || !result.Valid {
    // quarantine tag, surface result.Issues to the partner
}

Java — vastlint-java (gRPC client, no JNI):

try (VastlintClient client = VastlintClient.connect("localhost:50051")) {
    Verdict verdict = client.validate(xml);
    if (!verdict.getValid()) {
        // quarantine tag, surface verdict.getIssuesList() to the partner
    }
}

Talks to vastlint-grpc. Same catalog as Go. See vastlint-java.

Elixir / Erlang — vastlint-erlang (BEAM, OTP-safe):

Two integration modes are available. For production ad delivery, use the OTP port mode — vastlint-cli runs as a supervised OS process, so a crash is fully isolated and never affects the BEAM node:

# OTP port mode — recommended for production ad delivery
# See vastlint-erlang README for full NimblePool supervision tree setup
case MyApp.VastValidator.validate(xml) do
  %{valid: true}    -> :ok
  %{issues: issues} -> {:reject, issues}
  {:error, reason}  -> {:error, reason}
end

The DirtyCpu NIF remains available for non-critical paths where the ~10–50 µs port overhead matters:

# NIF mode — opt-in, for non-critical paths only
case Vastlint.validate(xml_string) do
  {:ok, %{summary: %{errors: 0}}} -> :ok
  {:ok, result} -> {:reject, result.issues}
  {:error, reason} -> {:error, reason}
end

All four bindings share the same compiled Rust core. Identical rule enforcement, same rule IDs in the response. See the ad server integration guide for production patterns including per-partner rule overrides, revenue-impact rule filtering, and structured error reporting back to demand partners.

Use from JavaScript / TypeScript

vastlint is published on npm. Same 234 rules, same core - compiled to WASM.

npm install vastlint

import { validate } from 'vastlint';

const result = validate(xmlString);
if (!result.summary.valid) {
  for (const issue of result.issues) {
    console.error(`[${issue.severity}] ${issue.id}: ${issue.message}`);
  }
}

Works in Node.js (ESM and CJS), Vite, Webpack 5, and Rollup. Requires a bundler for browser use - see the npm package README for the full environment compatibility table and API reference.

Use from Go

vastlint-go provides Go bindings via CGo. Prebuilt static libraries are included - no Rust toolchain required.

go get github.com/aleksUIX/vastlint-go

import vastlint "github.com/aleksUIX/vastlint-go"

result, err := vastlint.Validate(xmlString)
if err != nil {
    log.Fatal(err)
}
if !result.Valid {
    for _, issue := range result.Issues {
        fmt.Printf("[%s] %s (%s)\n", issue.Severity, issue.Message, issue.ID)
    }
}

Supported platforms: Linux (amd64, arm64), macOS (amd64, arm64).

With options:

result, err := vastlint.ValidateWithOptions(xmlString, vastlint.Options{
    WrapperDepth:    2,
    MaxWrapperDepth: 5,
    RuleOverrides: map[string]string{
        "VAST-2.0-mediafile-https":       "error",
        "VAST-4.1-mezzanine-recommended": "off",
    },
})

See the vastlint-go README for the full API reference.

Use from Java

vastlint-java is a gRPC client for JVM ad servers. Same catalog as Go. Talks to vastlint-grpc rather than loading JNI on the auction thread.

implementation("io.openadtech:vastlint:0.13.0")

import io.openadtech.vastlint.VastlintClient;
import io.openadtech.vastlint.v1.Verdict;

try (VastlintClient client = VastlintClient.connect("localhost:50051")) {
    Verdict verdict = client.validate(xmlString);
    if (!verdict.getValid()) {
        verdict.getIssuesList().forEach(issue ->
            System.err.printf("[%s] %s (%s)%n",
                issue.getSeverity(), issue.getMessage(), issue.getRuleId()));
    }
}

Run the server first: docker run --rm -p 50051:50051 -p 9090:9090 aleksuix/vastlint-grpc:0.13.2. Set x-vastlint-caller to a stable partner id (seat, DSP, AdSystem); verdicts and $ findings land on /metrics. Grafana: docker compose --profile pipeline up --build. See the vastlint-java README for GitHub Packages, JitPack, TLS, and options. The Java client tag is still 0.13.0; the sidecar image tracks this repo.

Use from VS Code

Install the VASTlint extension from the VS Code Marketplace. VAST XML files are validated as you type with clean Problems entries, concise hovers, direct rule docs links, and no terminal required.

ext install aleksuix.vastlint

Or search for vastlint in the VS Code Extensions panel.

Use from Chrome

The VASTlint Chrome extension detects VAST XML on any page and shows inline validation errors, warnings, and info messages - squiggly underlines, hover tooltips, and a collapsible panel, all powered by the same VASTlint core.