RTBlint
v0.5.0Bid · OpenRTB 2.0 through 3.0
Validates OpenRTB bid requests and bid responses against versioned IAB spec snapshots.
16versioned spec snapshots
crates.ionpmWASMBrowser testerMCP
Open conformance tooling for the ad tech stack.
Digital advertising runs on published specifications that nothing enforces at runtime. A malformed bid request, a broken wrapper chain, and a misspelled pixel event all fail silently. OpenAdTech builds the validators that catch them, before the impression is spent.
Every arrow is a handoff between two companies, governed by a published spec, with no runtime that enforces it. That gap is where impressions go missing. Each tool grades one crossing, and each box links to the source that does it.
What OpenAdTech is
Closing the gaps that let the ad supply chain leak.
OpenAdTech is an open-source project building the conformance layer digital advertising never got. The specifications exist and are public. What is missing is anything that checks a payload against them at the moment it crosses between two companies. That gap is where revenue leaks, where user data travels unreviewed, where fraud becomes indistinguishable from error, and where autonomous systems now transact with nothing verifying them. Every tool here is free, auditable, cites the document behind each finding, and is built to run inside that gap.
Revenue integrity
A tag that fails renders nothing and still bills. The rules that catch it are the unglamorous ones: a missing impression element, a duplicate one that double-counts, a media file on plain HTTP that secure inventory blocks, quartile tracking nobody wired so measurement receives no signal at all.
VAST-2.0-inline-impressionVAST-2.0-duplicate-impressionVAST-2.0-linear-tracking-quartiles
User data and privacy
Tracking URLs are where identifiers actually travel, and they are the least reviewed artifact in the chain. Pixellint flags raw email addresses sent where the vendor requires SHA-256 hashing, credentials embedded in a URL, macros fired unexpanded to a third party, and any tracker still riding plaintext HTTP.
vendor.meta.pii.unhashed_emailcore.url.userinfo_deprecatedcore.macro.unexpanded_in_fired_url
Verifiability and fraud
A malformed payload and a fraudulent one look identical to everything downstream, because both are unverifiable. These tools do not detect fraud. They remove the ambiguity fraud hides in, by checking that the verification resources meant to catch it are present, correctly declared, and reachable.
VAST-4.1-verification-vendorVAST-4.1-verification-no-resourceVAST-4.1-js-resource-https
Agentic accountability
Buying is moving to agents on both sides of the transaction, with no human reading a validator UI in between. Every tool ships an MCP server so an agent can check its own output deterministically, and VASTlint implements AdCP 3.0 governance so a pipeline can declare and enforce content standards rather than assume them.
get_adcp_capabilitiescalibrate_contentvalidate_content_delivery
Each chip is a real rule or tool id you can look up in the catalog. Nothing on this page describes something we intend to build.
The suite
Three validators, one per handoff.
Each tool takes an artifact that crosses a company boundary and grades it against the spec that governs it. Same engine design, same output contract, same license. Learn one and you know all three.
VASTlint
v0.9.1Creative · IAB VAST 2.0–4.4
Validates, inspects, and repairs VAST ad tags, including wrapper chains, SIMID, VMAP, and DAAST.
195validation rules
crates.ionpmPyPIRubyGemsGo moduleErlang/Elixir NIF+5 more
Pixellint
EarlyMeasurement · Vendor rulepacks and measurement conventions
Validates impression pixels, click trackers, and conversion postbacks against vendor-documented rulepacks.
6rulepacks shipping
crates.ioMCP
Use it in the browser
Every tool has a site you can run right now.
No install, no account, no key. Paste a payload into any of these and it grades against the same engine the CLI and the MCP server run.
RTBlint · OpenRTB 2.0 through 3.0
VASTlint · IAB VAST 2.0–4.4
Pixellint · Vendor rulepacks and measurement conventions
Business impact
The failures are silent, which is why they are expensive.
A broken ad tag does not throw. The auction still clears, the impression still bills, and the slot renders nothing. Every layer downstream reports success. That is why this category of loss survives quarterly review: no dashboard has a row for it.
40%
of video-on-demand ads fail to deliver as intended, a failure the buyer has usually already paid for.
18%
of global connected-TV traffic was invalid in Q2 2025. Some of that is fraud. A meaningful share is malformed payloads nobody validated.
Pixalate, Q2 2025 CTV Ad Fraud Benchmarks
$259B
in US internet advertising revenue in 2024. Single-digit conformance loss on a base that size is measured in billions.
IAB and PwC, Internet Advertising Revenue Report 2024
WhoWhat it costs you todayWhat changes with a validator in the path
Publishers and platforms
Broken creative is accepted at intake, serves a blank slot, and turns into a make-good negotiation weeks later with no evidence either side can point at.
Reject non-conforming tags at intake with a rule id and a spec citation. The conversation moves from opinion to document.
Buyers and DSPs
You pay for impressions that rendered nothing. Delivery reports say the campaign ran; the discrepancy surfaces at reconciliation, if at all.
Validate the creative before it is trafficked, and validate the bid payload before it costs you the auction. Failure moves upstream of spend.
Engineering and ad ops
An afternoon spent bisecting a five-hop wrapper chain by hand to find one HTTP media file, repeated for every integration.
One command walks the chain and names the failing hop, the rule, and the line. It runs in CI, so the next one never reaches a human.
Agentic pipelines
Agents on both sides of a transaction, and nothing deterministic checking that the payload they agreed on actually works. Nobody is watching it fail.
A verifier the agent calls in its own loop. Same verdict every run, against the published spec, with a citation a human can audit afterward.
The cost of adding this to your stack is one command and no license fee. That asymmetry is the entire argument.
Adoption
Published, installed, and in use.
Every figure below was read from a public registry API and can be checked against the same endpoint today. None of it is estimated, projected, or rounded up.
23,074
package installs across every channel we publish to, as of 2026-07-25
Packages published
13
Distribution channels
7
Cost to use
$0
Show the per-package numbers
| Channel | Package | Count |
|---|---|---|
| npm | vastlint | 9,221 |
| npm | rtblint-core | 454 |
| RubyGems | vastlint | 3,825 |
| crates.io | vastlint-core | 2,433 |
| crates.io | vastlint-cli | 850 |
| crates.io | rtblint-core | 192 |
| crates.io | rtblint-mcp | 87 |
| crates.io | rtblint | 84 |
| Docker Hub | aleksuix/vastlint | 1,913 |
| GitHub releases | vastlint | 1,622 |
| GitHub releases | vastlint-erlang | 213 |
| PyPI | vastlint | 1,865 |
| VS Code Marketplace | aleksuix.vastlint | 315 |
| Total | 23,074 | |
How these are counted. Read straight from each registry’s public API on 2026-07-25. Nothing is estimated or projected. crates.io and RubyGems report lifetime downloads. npm has no lifetime endpoint, so that figure sums the daily range API from each package’s first publish date. PyPI uses the without_mirrors series, which excludes mirror traffic and is the smaller of the two figures available. Registries count machines, not people, so treat this as reach, not headcount.
AI and agents
Built for agents, not just terminals.
Agentic buying is arriving faster than the guardrails around it. An agent that assembles a campaign needs to check its own work against the spec, in the loop, without a human reading a validator UI. Every tool here ships an MCP server for exactly that.
Findings come back as structured JSON: a stable rule id, a severity, the line it came from, and fix guidance. An agent can act on that. It cannot act on a screenshot of a validator UI. Each server links to its source.
RTBlint
3 toolsrtblint.org/mcp
validate_bid_requestvalidate_bid_responselist_openrtb_versions
VASTlint
14 toolsvastlint.org/mcp
validate_vastvalidate_vast_urlfix_vastlist_rulesexplain_ruleget_adcp_capabilitiesand 8 more
Pixellint
2 toolsstdio · local binary
validate_artifactlist_rulepacks
Wire all three into Claude Code in one file
{
"mcpServers": {
"vastlint": { "type": "http", "url": "https://vastlint.org/mcp" },
"rtblint": { "type": "http", "url": "https://rtblint.org/mcp" },
"pixellint": { "command": "pixellint-mcp" }
}
}19 callable tools across the three servers. Two are hosted over HTTP with no install and no account. The third runs as a local binary over stdio. Findings return as structured JSON with stable rule ids, so an agent can branch on a result instead of parsing prose.
Standards
Implementing what the standards bodies publish.
Specifications are written by industry bodies and implemented by everyone else. The gap between the two is where interoperability breaks. These tools live in that gap and cite their sources.
IAB Tech Lab specifications
The specs that define how a bid, a creative, and a measurement event are structured. Every rule in the catalog names the document it came from.
- OpenRTB 2.0 through 3.0, including eight dated 2.6 snapshots
- VAST 2.0 through 4.4, plus VMAP, DAAST, and SIMID
- OMID verification checks and VPAID deprecation detection
Agentic advertising and AdCP
The Ad Context Protocol defines how agents negotiate and transact advertising. Validation is the part that keeps an autonomous pipeline honest.
- AdCP 3.0 capability discovery over MCP
- Content standards governance with pre-flight calibration
- Idempotent tool calls with replay protection
Contributing back upstream.
Implementing a specification closely enough to validate it surfaces the places where the specification itself is wrong, ambiguous, or untested. Those findings go back to the people who maintain it, as patches to the specs and their reference implementations.
Sets the technical standards the open advertising supply chain runs on, including OpenRTB, VAST, VMAP, and the agentic bidding framework.
Participant in the Advanced TV Working Group, and an active contributor to the reference implementations and testing tools on GitHub.
See the contributions on GitHubMaintains the Ad Context Protocol, which defines how AI agents discover each other's capabilities and transact advertising.
Certified AdCP Practitioner and Governance Specialist, and an active contributor to the protocol specification on GitHub.
See the contributions on GitHubOpenAdTech is an independent open-source project. It implements published specifications from the IAB Tech Lab and the Agentic Advertising Organization. It is not affiliated with, endorsed by, or a working group of either organization.
How it is built
The same three commitments in every tool.
Every rule cites a source
A finding names the spec section, the XSD, the RFC, or the documented revenue impact behind it. If a rule cannot cite something, it does not ship. That is what makes a result arguable with a partner instead of just an opinion.
One engine, every runtime
A single Rust core compiles to a CLI, a WASM module, a native library, and language bindings. Your CI, your browser, your BEAM service, and your agent all get identical verdicts, because they run identical code.
Free, and staying that way
Apache 2.0, with a written commitment: no paid tier that hides rules, no cloud version that requires an account, no rate limits, no telemetry without opt-in. Validation infrastructure only works if everyone can run it.