← All posts

VASTlint: An Open-Source VAST Validator for Catching Broken Ad Tags Early

·

A broken VAST tag rarely announces itself. There is no error page and no crash report. The ad just does not play, a tracking pixel never fires, or two companies' impression counts quietly drift apart. By the time anyone notices, the campaign has been running for days and the money is spent.

Most VAST problems are mechanical: a missing required element, a malformed URL, a media file with the wrong type, an identifier in the wrong format. They are the kind of mistakes a machine can catch in milliseconds, long before a tag reaches a player or a stitching server. That is the job of VASTlint, an open-source VAST validator built by Alex Sekowski.

What VASTlint is

VASTlint is an independent, open-source project created by Alex Sekowski, released under the Apache 2.0 license, that checks video ad tags against the IAB Tech Lab specifications. Alex develops and maintains it, and its source code is on GitHub, where you can follow the project, report issues or contribute. It covers:

  • VAST 2.0 through 4.3, the current final version of the spec, with draft coverage of VAST 4.4 listed on the project site
  • VMAP 1.0, used to schedule ad breaks in long-form content
  • DAAST 1.0, the digital audio ad format

The project is clear that it is not an official IAB Tech Lab tool. It is built from the published standards, and it documents how each validation rule is derived from the IAB schemas and specification text.

What it checks

Checking a tag against the official XML schemas is a start, but schemas only cover structure. Much of what VAST requires lives in the written specification: which elements are required in which situations, what values are allowed, what a player must and should do. VASTlint encodes both. According to the project, its checks include:

  • XML well-formedness, checked before any spec rules run
  • Structural rules from the IAB XSD schemas, and requirements from the specification text itself, including VAST 4.3, which has no published schema
  • URL syntax for tracking, click and media URLs
  • Media types on media files and related elements
  • Ad-ID format for <UniversalAdId>, the creative identifier that ad-stitching services rely on
  • SIMID checks, including <InteractiveCreativeFile> with apiFramework="SIMID"
  • Open Measurement compatibility in <AdVerifications>
  • Currency codes on pricing elements

The project's README lists 246 rules, and flags the ones with a direct revenue impact. You can browse the full reference of VAST validation rules and errors, or start with the project's guide to the most common VAST errors and how to fix them.

Why it matters for SSAI and interactive ads

Several of these checks line up directly with problems we have written about on this blog.

In Why Serving Video Ads for SSAI Is Harder Than It Looks, we explained that ad-stitching servers use the <UniversalAdId> to manage their cache of transcoded creatives. A missing or malformed identifier can mean an ad that never gets stitched at all. Catching that in validation is far cheaper than discovering it in a delivery report.

Interactive ads add another layer. A SIMID creative has to be declared correctly in the VAST response for a player to load it, and we covered how that works in What Is SIMID? VASTlint publishes a dedicated set of SIMID validation rules for interactive VAST ads, so problems with the interactive declaration show up before the ad ships.

Ways to use it

VASTlint is built on a single Rust core and offered in several forms, so it can fit wherever tags are created, trafficked or served.

In the browser. The quickest way to try it is the free online VAST tag validator: paste or drop in a tag and get errors, warnings and advisories back. To check a live ad tag URL rather than pasted XML, use the VAST tag tester, and to follow a tag through its chain of wrappers, use the VAST inspector.

On the command line. The CLI installs with Cargo, and a small Docker image is also available:

cargo install vastlint
vastlint check tag.xml
vastlint check tag.xml --format json

In CI. The CLI returns exit code 0 for a valid tag, 1 for validation errors and 2 for a usage error, and it can fail on warnings too. That makes it easy to stop a broken tag from being merged or deployed.

Inside your ad server. Libraries are available for Rust, JavaScript and TypeScript (via WebAssembly on npm), Go, Python and Erlang/Elixir, plus a gRPC sidecar for other languages, so tags can be validated at runtime as they are served. The project has an ad server integration guide for this.

In your editor and AI tools. There is a VS Code extension, and an MCP server that lets AI assistants validate tags directly.

The CLI also includes a vastlint fix command that can repair some problems automatically. The project describes it as opinionated and experimental, and recommends previewing changes with --dry-run and reviewing the result before using it.

A note on privacy

Ad tags can contain campaign details and client information, so it is worth knowing where they go. According to the project, the CLI sends nothing unless you opt in with specific flags, while the hosted web tools and the MCP endpoint may store redacted copies of submitted tags. For sensitive tags, run the CLI or a library locally.

What validation can and cannot tell you

A clean validation report means a tag follows the specification. It does not guarantee that every player, device and stitching service will play it, since real-world platforms have their own quirks and requirements. Validation is the first gate, not the last: it catches the mechanical errors early so that testing on real players can focus on everything else.

That makes a simple workflow worth adopting:

  1. Validate every tag before trafficking it, whether by hand in the browser or automatically in CI.
  2. Validate at the ad server if you generate or modify VAST dynamically.
  3. Pay special attention to the elements that SSAI and interactive ads depend on: <UniversalAdId>, <Mezzanine>, <InteractiveCreativeFile> and tracking URLs.
  4. Then test on real players and stitching services for the platforms your campaign runs on.

If you work with VAST, start with the project's walkthrough on how to validate a VAST tag, then try it on the tags you are running today. Broken tags are much cheaper to fix before the campaign starts than after. Thanks to Alex Sekowski for building VASTlint and sharing it with the ad tech community as open source.

Building interactive video ads that need to work across every player and screen? Get in touch.

← All posts