Vastlint MCP Server

vastlint

Website & web validator: VAST tag validator Paste a VAST tag and get results in your browser, no install required.

A VAST XML validator. Checks ad tags against the IAB Tech Lab VAST specification so you don't have to read it. Over $30 billion in annual CTV and video ad spend flows through VAST XML, and malformed tags are one of the most common causes of lost impressions, broken tracking, and revenue discrepancies between platforms. There is no widely adopted open-source tool that validates VAST XML against the full IAB specification across all published versions.

vastlint ships a native MCP server — making VAST validation available as a callable tool inside any MCP-compatible AI agent or agentic workflow. Connect Claude, Cursor, or the AAMP Buyer Agent SDK to vastlint.org/mcp and your agent can validate a creative before trafficking it, with no human in the loop. The server exposes validate_vast, validate_vast_url, list_rules, explain_rule, and fix_vast as structured tools that return JSON a downstream agent can act on directly.

Validates VAST documents against:

• IAB Tech Lab VAST 2.0, 3.0, 4.0, 4.1, 4.2, and 4.3. Structural rules derived from the published XSD schemas and spec prose
• W3C XML 1.0 well-formedness (malformed documents are rejected before any spec rule runs)
• RFC 3986 URI syntax (all URL fields)
• IANA Media Types (MediaFile and resource MIME types)
• ISO 4217 currency codes (Pricing elements)
• Ad-ID registry format (UniversalAdId)

108 rules across required fields, schema validation, structural correctness, security, consistency, deprecated features, ambiguous usage, and value formats. See common errors for the ones that cost real money. New to vastlint? Start with the tutorial.

Full rule reference with examples and fix instructions: VAST error rule reference

Install

cargo install vastlint

CLI crate on crates.io: crates.io/crates/vastlint

Or download a pre-built binary from the releases page.

Docker

Pull the image from Docker Hub:

docker pull aleksuix/vastlint

Validate a file:

docker run --rm -v "$(pwd)":/data aleksuix/vastlint check /data/tag.xml

Pipe from stdin:

cat tag.xml | docker run --rm -i aleksuix/vastlint check -

DOCKERHUB_TOKEN JSON output:

docker run --rm -v "$(pwd)":/data aleksuix/vastlint check /data/tag.xml --format json

Validate a whole directory:

docker run --rm -v "$(pwd)/tags":/data aleksuix/vastlint check /data/*.xml

The image is built FROM scratch — a fully-static musl binary with no OS layer. Compressed size is under 5 MB. Cold-start to first result is under 10 ms.

Usage

# validate a file
vastlint check tag.xml

# validate multiple files
vastlint check *.xml

# read from stdin
cat tag.xml | vastlint check -

# JSON output (one object per file, newline-delimited)
vastlint check tag.xml --format json

# suppress colours
vastlint check tag.xml --no-color

# exit 0 even on errors (useful in some CI setups)
vastlint check tag.xml --no-fail

# opt in to anonymous usage telemetry (see Telemetry section below)
vastlint check tag.xml --telemetry

# list all rules with default severity
vastlint rules

# automatically fix common issues and overwrite the file
vastlint fix tag.xml

# fix and write to a new path instead of overwriting
vastlint fix tag.xml --out tag-fixed.xml

# preview what would change without writing anything
vastlint fix tag.xml --dry-run

# fix from stdin, repaired XML goes to stdout
cat tag.xml | vastlint fix -

Example output:

tag.xml  VAST 4.2
  error    <Duration> value does not match required format HH:MM:SS or HH:MM:SS.mmm  VAST-2.0-duration-format
           /VAST/Ad[0]/InLine/Creatives/Creative[0]/Linear/Duration
  error    <MediaFile> delivery attribute must be "progressive" or "streaming"  VAST-2.0-mediafile-delivery-enum
           /VAST/Ad[0]/InLine/Creatives/Creative[0]/Linear/MediaFiles/MediaFile[0][@delivery]
  info     <MediaFiles> has no <Mezzanine> — ad-stitching servers may reject this tag  VAST-4.1-mezzanine-recommended
           /VAST/Ad[0]/InLine/Creatives/Creative[0]/Linear/MediaFiles

✖ 2 errors, 0 warnings, 1 info

Auto-fix ⚠️ experimental

vastlint fix is opinionated and experimental. It applies a small set of deterministic, low-risk repairs (HTTPS upgrades, conditionalAd removal). Always review the diff before committing. Use --dry-run first, and re-run check afterward to confirm the result. Future releases may make individual fixes configurable.

vastlint fix repairs fixable issues and writes the corrected XML back to the file (or to a separate path with --out):

# preview changes without writing (recommended first step)
vastlint fix tag.xml --dry-run

# overwrite the file in place
vastlint fix tag.xml

# write to a new file instead of overwriting
vastlint fix tag.xml --out tag-fixed.xml

# JSON report of what was fixed
vastlint fix tag.xml --format json

# pipe from stdin → repaired XML to stdout
cat tag.xml | vastlint fix -

Not every rule is auto-fixable — some require human judgment (e.g. choosing the right <AdSystem> value). After running fix, re-run check to confirm the remaining issues.

Exit codes

Config file

Create vastlint.toml anywhere in your project tree. vastlint searches up from the current directory and uses the first one it finds.

[rules]
"VAST-2.0-mediafile-https" = "off"
"VAST-4.1-vpaid-apiframework" = "warning"

Valid levels: error, warning, info, off.

Use --config <path> to specify a config file explicitly, or --no-config to ignore all config files.

CI

# .github/workflows/vast-lint.yml
- name: Install vastlint
  run: cargo install vastlint

- name: Validate VAST tags
  run: vastlint check tags/**/*.xml

Or download a release binary instead of building from source:

- name: Install vastlint
  run: |
    curl -sL https://github.com/aleksUIX/vastlint/releases/latest/download/vastlint-x86_64-linux-musl.tar.gz \
      | tar xz -C /usr/local/bin

- name: Validate VAST tags
  run: vastlint check tags/**/*.xml

JSON output

--format json emits one JSON object per file, one per line (NDJSON). This makes it easy to process output with jq or pipe it into other tools.

{"file":"tag.xml","version":"4.2","valid":false,"summary":{"errors":1,"warnings":2,"infos":0},"issues":[{"id":"VAST-2.0-inline-adsystem","severity":"error","message":"<InLine> must contain <AdSystem>","path":"/VAST/Ad[0]/InLine","spec_ref":"IAB VAST 2.0 §2.2.1"}]}

Fields:

Use as a library

vastlint-core is published separately as a library crate. Full API documentation is on docs.rs.

[dependencies]
vastlint-core = "0.1"

use vastlint_core::validate;

let result = validate(xml_string);
if result.summary.is_valid() {
    println!("valid");
} else {
    for issue in &result.issues {
        println!("{}: {}", issue.id, issue.message);
    }
}

To override rule levels programmatically:

use std::collections::HashMap;
use vastlint_core::{validate_with_context, RuleLevel, ValidationContext};

let mut overrides = HashMap::new();
overrides.insert("VAST-2.0-mediafile-https", RuleLevel::Off);

let ctx = ValidationContext {
    rule_overrides: Some(overrides),
    ..Default::default()
};

let result = validate_with_context(xml_string, ctx);

Use from JavaScript / TypeScript

vastlint is published on npm. Same 108 rules, same core — compiled to WASM.

npm install vastlint

import { validate } from 'vastlint';

const result = validate(xmlString);
if (!result.summary.valid) {
  for (const issue of result.issues) {
    console.error(`[${issue.severity}] ${issue.id}: ${issue.message}`);
  }
}

Works in Node.js (ESM and CJS), Vite, Webpack 5, and Rollup. Requires a bundler for browser use — see the npm package README for the full environment compatibility table and API reference.

Use from Go

vastlint-go provides Go bindings via CGo. Prebuilt static libraries are included — no Rust toolchain required.

go get github.com/aleksUIX/vastlint-go

import vastlint "github.com/aleksUIX/vastlint-go"

result, err := vastlint.Validate(xmlString)
if err != nil {
    log.Fatal(err)
}
if !result.Valid {
    for _, issue := range result.Issues {
        fmt.Printf("[%s] %s (%s)\n", issue.Severity, issue.Message, issue.ID)
    }
}

Supported platforms: Linux (amd64, arm64), macOS (amd64, arm64).

With options:

result, err := vastlint.ValidateWithOptions(xmlString, vastlint.Options{
    WrapperDepth:    2,
    MaxWrapperDepth: 5,
    RuleOverrides: map[string]string{
        "VAST-2.0-mediafile-https":       "error",
        "VAST-4.1-mezzanine-recommended": "off",
    },
})

See the vastlint-go README for the full API reference.

Use from VS Code

Install the vastlint extension from the VS Code Marketplace. VAST XML files are validated as you type — errors and warnings appear inline with rule IDs and spec references, no terminal required.

ext install aleksuix.vastlint

Or search for vastlint in the VS Code Extensions panel.

Use from Chrome

The VAST Lint Chrome extension detects VAST XML on any page and shows inline validation errors, warnings, and info messages — squiggly underlines, hover tooltips, and a collapsible panel, all powered by the same vastlint core.

Install from the Chrome Web Store (pending review): VAST Lint – Chrome Web Store

Or install manually (no review wait):

1. Download vastlint-extension.zip from the latest GitHub Release
2. Unzip it anywhere
3. Open chrome://extensions and enable Developer mode (top-right toggle)
4. Click Load unpacked → select the unzipped folder
5. Navigate to any page serving VAST XML — the panel appears automatically

The toolbar icon badge shows the error count for the current tab. Click it for a per-severity summary.

Use from an AI agent (MCP)

vastlint-mcp is a Model Context Protocol server. It exposes validate_vast, validate_vast_url, list_rules, explain_rule, and fix_vast as native tools callable by Claude, Cursor, and any MCP-compatible agent.

Agentic advertising workflows — As AI agents take over creative trafficking (see IAB Tech Lab AAMP), validation needs to move into the agent loop. The vastlint MCP server is compatible with the AAMP Buyer Agent SDK: an agent calls validate_vast or validate_vast_url before confirming a deal, gets a structured pass/fail result with rule IDs and XPath locations, and can reject or escalate without a human reviewing the tag. The same tool works in Claude Desktop, Cursor, Copilot, any MCP client, and CI pipelines.

No-install hosted endpoint — connect directly without installing anything:

{
  "mcpServers": {
    "vastlint": {
      "type": "sse",
      "url": "https://vastlint.org/mcp"
    }
  }
}

Local install (stdio transport):

cargo install vastlint-mcp

{
  "mcpServers": {
    "vastlint": {
      "command": "vastlint-mcp"
    }
  }
}

Listed on the MCP Registry as io.github.aleksUIX/vastlint. See crates/vastlint-mcp for the full tool reference.

Use as a REST API

Available on RapidAPI. Send a POST /validate request with your VAST XML and get a full validation result back — no SDK, no install.

curl -X POST https://vastlint.p.rapidapi.com/validate \
  -H "Content-Type: application/json" \
  -H "X-RapidAPI-Key: <your-key>" \
  -H "X-RapidAPI-Host: vastlint.p.rapidapi.com" \
  -d '{"xml":"<VAST version=\"4.2\">...</VAST>"}'

Returns the same structured result as the CLI and library: version, issues with rule IDs and line/col positions, and a summary. See the RapidAPI listing for full endpoint docs and pricing.

Use from a browser

Paste any VAST tag into the web validator at VAST tag validator — no install, no account, nothing stored. Runs the same 108 rules as the CLI, entirely in your browser via WebAssembly.

Performance

Benchmarked on Apple M4 (10-core), production-realistic VAST tags (17–44 KB):

A typical OpenRTB bid cycle takes 100–300 ms; validation adds less than 2.1% of that budget even on the heaviest tags. An SSAI pipeline doing 1,000 stitches/sec spends more time on DNS than on validating the VAST response.

No async runtime, no regex engine, no schema interpreter. Rules are compiled Rust functions. Three dependencies: quick-xml, url, and phf (compile-time hash maps).

Telemetry

Off by default. CLI only -- the core library has no network code. Enable with --telemetry or telemetry = true in vastlint.toml.

Sends one HTTP GET per CLI invocation with: version, OS, anonymous install ID, file count. No file names, no file contents, no personal data. The install ID is a random 128-bit hex value stored in ~/.config/vastlint/id. The ping fires in a background thread with a 2-second timeout and is silently dropped on any error.

Roadmap

See ROADMAP.md for what's shipped, what's in progress, and what's next.

Supply Chain Security

All release artifacts are built with SLSA Build Level 3 provenance. Provenance is generated by an isolated slsa-github-generator signing job that is independent of the build — the build process cannot tamper with what is signed.

Every binary, library, and WASM artifact attached to a GitHub Release includes a signed .intoto.jsonl provenance file. Verify any artifact:

# GitHub CLI
gh attestation verify vastlint-linux-x86_64.tar.gz --repo aleksUIX/vastlint

# slsa-verifier
slsa-verifier verify-artifact vastlint-linux-x86_64.tar.gz \
  --provenance-path multiple.intoto.jsonl \
  --source-uri github.com/aleksUIX/vastlint

# npm package
npm audit signatures vastlint

The OpenSSF Scorecard score is updated weekly.

Fuzzing

vastlint uses cargo-fuzz (libFuzzer) to continuously test the validator and auto-fix engine against arbitrary inputs.

Three fuzz targets run on every CI push and pull request for 30 seconds each, seeded from the test fixture corpus:

To run locally:

# Requires nightly Rust and cargo-fuzz
cargo +nightly fuzz run validate -- -max_total_time=60
cargo +nightly fuzz run fix -- -max_total_time=60
cargo +nightly fuzz run validate_wrapper -- -max_total_time=60

Roadmap

VAST XML is not a standalone spec — it references several adjacent IAB Tech Lab standards that introduce validatable elements and attributes. Upcoming work:

See ROADMAP.md for the full plan including infrastructure milestones.

License

See FREE_FOREVER.md for the free-use commitment.

The CLI and library are licensed under Apache 2.0. Use freely in any project, open-source or proprietary. The only requirement is to retain the NOTICE file (and the copyright header in the LICENSE) in any distribution — this provides attribution back to the project.

If you distribute vastlint or a derivative work, include the NOTICE file verbatim. That is the entire obligation.

Contributing

See CONTRIBUTING.md.

Research

Sekowski, A. (2026). VAST XML Validation at Bid-Time Scale: Latency Analysis and Integration Patterns for Programmatic Video Pipelines. Preprint. DOI: 10.13140/RG.2.2.11404.27520

Community

Using vastlint in production or in your workflow? Let us know!

Contact

For commercial inquiries, consulting, or enterprise support, open a GitHub Discussion.