Quartermaster

Quartermaster

This project started because I wanted to prototype a dam.

Nothing serious — a short demo, maybe more if it worked out. Before building anything, I wanted to see what I already owned that could speed it up. So I searched my library for "dam": nothing came back. Of course nothing came back — no asset is *called* a dam. But spread across four packages I already owned were curved concrete meshes, a water system, some rocky terrain. Everything the dam needed. I'd had most of it for years and never once connected the pieces.

That's what ~1,500 assets across two stores did to me when this started — a library that has since grown past 7,500 assets across five ecosystems. Almost all of it from bundles and sales, none of it remembered. And it's not just me — no AI assistant knows either. Ask one for help and it either builds everything from scratch or sends you shopping, while hundreds of dollars of exactly-the-right-thing sits on your disk.

Quartermaster indexes everything you own across the Unity Asset Store, Fab, Quixel Megascans, Gumroad and Leartes Cosmos — locally, on your machine — and serves it to your coding agent over MCP. It's the tool I wished existed that day: ask about a dam, get told you already own curved concrete meshes.

you    →  "I want to build a dam — what do I have to work with?"

agent → search_owned_assets(...) finds the concrete meshes, water FX, terrain └─ Nordic Coastal Cliff (Quixel) · 5785 px/m · 2.03 × 2.92 × 2.44 m maps: Basecolor, Normal, Displacement, Cavity, AO, Roughness… validate_stack([...]) checks none of them fight each other import_asset_to_project(...) unpacks into Assets/, demos stripped

Every result is something you own or can claim free — nothing is invented.

*Typing a description, not a name — none of those results share a word with the query.*

Why *Quartermaster*? A quartermaster's job was never remembering what's in stores — it's making sure you're equipped when it's time to move. That's nearer the real problem than forgetting is. I hadn't lost anything; I knew I owned *stuff*. What I couldn't do was get from "I want to prototype a dam" to "open these four packages" without an hour of digging first — and *maybe more if it worked out* doesn't survive an hour of digging. Ideas that arrive that way don't get rejected. They just quietly don't happen, and you never find out whether they would have.

What it indexes

Everything lands in one SQLite table behind one search surface, so a query crosses all of them at once. Nothing is engine-scoped: a Megascans surface and a Unity shader come back from the same question if they both answer it.

The part nobody tells you

Neither store will admit what you own.

Unity removed /account/purchases (404 since August 2026). Fab has no ownership API, no export button, nothing. Your purchase history exists only inside their private GraphQL, behind SSO, MFA, and bot detection.

Getting at it took four attempts, three of them failures:

1. Playwright's bundled Chromium — Epic's captcha refuses it outright ("enable JavaScript").
2. Playwright driving your real browser — injects detectable hooks; Epic throws a second security wall after the password.
3. Debugger attached during sign-in — same result. Anything touching the login flow gets flagged.
4. What actually works: stop automating the sign-in entirely. You log in through an ordinary browser window — no debug port, nothing between you and the store — because the automation was itself what tripped the risk systems. Only *after* you're done, on a session you established yourself, does Quartermaster attach a debugger and replay the store's own paginated queries — with its own CSRF headers, its own chunking (42 IDs per request, because that's what Unity's client sends).

That trick is most of this project. The rest — search, linting, unpacking — is honestly straightforward by comparison.

Two hard-won rules baked into the design, if you ever hack on this yourself:

• Browsers must close *gracefully* (taskkill without /F). An abrupt kill loses Unity's device-trust cookie and you'll get MFA-challenged on every future session.
• Never run a library fetch headless. Headless triggers Unity's risk system even with valid cookies.

Quixel Megascans, and why your Fab library looks short

Fab's library view and the Megascans catalog are not the same list, and there is no export that reconciles them — you can hold rights to far more Megascans content than your library page displays. Whatever the cause, the practical result is the same: scrolling and hand-searching for something you already have.

Quartermaster sidesteps it. It syncs the Quixel Megascans and Quixel Megaplants seller catalogs from Fab directly — 5,580 listings as of this writing — independently of what your library view shows, and files them next to everything else you own, tagged by status:

• `vault_owned` — in your library
• `catalog_grant` — claimable free under the Epic Content License, not yet acquired

Both are searchable, and every result says which it is, so an agent can tell "you own this" from "you can have this for nothing" without guessing.

Megascans rows also carry their physical specs where the listing publishes them — texel density, scan area, and the map list (basecolor, normal, displacement, cavity, AO, roughness…). That is the difference between an agent telling you it found a rock and an agent telling you it found a 1×1 m scan at 8192 px/m with displacement — which is the part that decides whether it's usable.

python -m src.store_client sync-quixel      # catalog

python -m src.store_client enrich-quixel # texel density, scan area, maps

What you get

Search that understands intent & vision. This is the dam problem.

• Exact keywords via SQLite FTS5.
• Natural language intent via local ONNX text embeddings (BAAI/bge-small-en-v1.5) — *"concrete structures for holding back water"* surfaces meshes and shaders whose listings never mention dams.
• Cross-modal visual understanding via ONNX CLIP embeddings (Qdrant/clip-ViT-B-32) — searching *"gothic cathedral"* literally scores your screenshots and promo renders, finding assets even when their text descriptions are completely silent. A visual hit also hands back *which* screenshot matched, not just the cover art.
• Every result shows its working. Each hit carries a match field — keyword, semantic+vision, keyword+semantic+vision — so you and your agent can see which signal fired. A pure-vision hit on a listing with useless marketing copy is a different kind of result than an exact title match, and it should be legible as one.
• Concept tags mined from screenshots. The offline vision pass scores every gallery image against a visual vocabulary and writes the survivors back into the FTS index, so *"medieval village"* and *"dark horror atmosphere"* become keyword-searchable on assets whose descriptions never said either. The vocabulary is a JSON file you can replace — see docs/concepts.md.

All three signals are fused with 3-way Reciprocal Rank Fusion (RRF) on your CPU. No GPU, no vector database process, no cloud API — ONNX Runtime and a numpy matrix, in the same process as everything else.

Measured on a ~7,500-asset vault: ~520 MB peak RAM with both models resident, ~1.4 s for the first query (loading BGE and CLIP), ~85 ms warm after that. The models load lazily, so an agent that never searches never pays for them.

Ground truth about your disk. Scans %APPDATA%/Unity/Asset Store-5.x/ and Epic's VaultCache so every result knows whether it's already downloaded or cloud-only. Agents prefer what's local — a zero-download import beats a 4 GB one.

A linter for stacks. Two vegetation renderers will fight. A MicroSplat module without core MicroSplat silently does nothing. A URP-only shader in an HDRP project renders pink. Quartermaster catches these before you spend an afternoon on them.

Direct unpacking. Extracts cached .unitypackage files straight into Assets/, dropping /Demo/, /Samples/, /Documentation/ and PDFs on the way in — typically 60–80% less bloat per package. Every declared path is normalized and asserted inside /Assets/; escapes are structurally impossible, not just filtered.

Install

The standalone bundle — download Quartermaster-windows-x64.zip from Releases, unzip anywhere. No Python required.

• Quartermaster.exe — Desktop GUI with Win+Alt+V spotlight search, store harvesting, library browsing, and direct unpacking.
• Quartermaster-mcp.exe — Standalone MCP stdio server for Claude Desktop, Cursor, Antigravity, and Windsurf.

Your library data lives safely in %LOCALAPPDATA%\Quartermaster, so upgrades are simple folder replacements with zero data loss.

From source — needs Python 3.10+.

git clone https://github.com/Tanshaydar/Quartermaster.git

cd Quartermaster pip install -r requirements.txt

Seed your library:

1. Sign in. The one step that needs you. A normal browser window opens; 2FA and captchas behave exactly as they always do. Close it when you're done and the session persists locally.

python -m src.store_client login unity

python -m src.store_client login fab python -m src.store_client login gumroad # optional python -m src.store_client login cosmos # optional — Leartes Cosmos

2. Harvest and enrich. Long-running, resumable, safe to re-run — each picks up where it stopped.

python -m src.store_client fetch unity

python -m src.store_client fetch fab python -m src.store_client fetch gumroad # if you signed in above python -m src.store_client fetch cosmos # if you signed in above python -m src.store_client sync-quixel # Megascans/Megaplants catalog — no login needed python -m src.store_client enrich # descriptions and cover art, politely batched python -m src.store_client enrich-quixel # Megascans scan specs python -m src.store_client fab-deep-media # Fab only: plain HTTP is 403'd, galleries need the authed browser

**3. Build the local indexes, then scan your