Atlas / MCP servers / aleksuix / vastlint

vastlintBLOCK

Name: vastlint
Author: aleksuix

mcp/aleksuix/vastlint

MCP server by aleksuix · adtech · gemini cli extension · linter · Audited 2026-10-10

⚑ Report / re-scan Source ↗

IAB VAST, VMAP, and DAAST validator. Hosted MCP at https://vastlint.org/mcp (auth none).

Verdict

BLOCK

Grade

Trust score

67 /100

Exposed tools

—

Transport

sse · stdio

License

Apache-2.0

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Website & web validator: VAST tag validator Paste a VAST tag and get results in your browser, no install required.

A high-performance VAST XML validator built on a pure-Rust core. Checks ad tags against the IAB Tech Lab VAST specification so you don't have to read it. Over $30 billion in annual CTV and video ad spend flows through VAST XML, and malformed tags are one of the most common causes of lost impressions, broken tracking, and revenue discrepancies between platforms. There is no widely adopted open-source tool that validates VAST XML against the full IAB specification across all published versions.

VASTlint ships a native MCP server - making VAST validation available as a callable tool from Claude, Cursor, the AAMP Buyer Agent SDK, or any MCP-compatible client. Connect to vastlint.org/mcp and call validate_vast, validate_vast_url, inspect_vast, list_rules, explain_rule, or fix_vast. Each tool returns structured JSON with rule IDs, XPath locations, and spec references.

Native bindings for realtime ad pipelines: `vastlint-go` (CGo, prebuilt static libs, no Rust toolchain needed), `vastlint-java` (gRPC client for JVM ad servers), `vastlint-erlang` (Elixir/Erlang: OTP port mode for production ad delivery, DirtyCpu NIF for non-critical paths), and a WASM npm package for Node.js and browsers. All bindings share the same compiled Rust core. Consistent results everywhere, sub-millisecond latency at scale.

Need a copy-paste frontend starting point? See the React drop-in example in npm/examples.

[](https://crates.io/crates/vastlint-cli) [](h

Read from source at commit 1d31a29518a4OBSERVED · 2026-10-10

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code

claude mcp add vastlint -- npx -y [email protected]

claude-desktop

{
  "mcpServers": {
    "vastlint": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ]
    }
  }
}

Trust audit

BLOCKgrade D · trust 67/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	WARN
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	PASS
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (4 observation(s))
Network: declared (2 observation(s))
Shell: declared (1 observation(s))
Dependencies: not all pinned
Secrets in source: none-found

Findings (25)

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

node_modules/typescript/lib/lib.es5.d.ts:998

exec(string: string): RegExpExecArray | null;

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

MEDIUMInventory / provenance · inv.binary · CWE-1104

chrome/vast-lint-extension.zip

vast-lint-extension.zip

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

MEDIUMInventory / provenance · inv.binary · CWE-1104

vscode/vastlint-0.4.1.vsix

vastlint-0.4.1.vsix

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

MEDIUMInventory / provenance · inv.binary · CWE-1104

vscode/vastlint-0.4.5.vsix

vastlint-0.4.5.vsix

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

MEDIUMInventory / provenance · inv.symlink · CWE-1104

node_modules/.bin/tsc

node_modules/.bin/tsc