Quartermaster

This project started because I wanted to prototype a dam.

Nothing serious — a short demo, maybe more if it worked out. Before building anything, I wanted to see what I already owned that could speed it up. So I searched my library for "dam": nothing came back. Of course nothing came back — no asset is called a dam. But spread across four packages I already owned were curved concrete meshes, a water system, some rocky terrain. Everything the dam needed. I'd had most of it for years and never once connected the pieces.

That's what ~1,500 assets across two stores did to me when this started — a library that has since grown past 7,500 assets across five ecosystems. Almost all of it from bundles and sales, none of it remembered. And it's not just me — no AI assistant knows either. Ask one for help and it either builds everything from scratch or sends you shopping, while hundreds of dollars of exactly-the-right-thing sits on your disk.

Quartermaster indexes everything you own across the Unity Asset Store, Fab, Quixel Megascans, Gumroad and Leartes Cosmos — locally, on your machine — and serves it to your coding agent over MCP. It's the tool I wished existed that day: ask about a dam, get told you already own curved concrete meshes.

you    →  "I want to build a dam — what do I have to work with?"

agent  →  search_owned_assets(...)        finds the concrete meshes, water FX, terrain
          └─ Nordic Coastal Cliff (Quixel) · 5785 px/m · 2.03 × 2.92 × 2.44 m
             maps: Basecolor, Normal, Displacement, Cavity, AO, Roughness…
          validate_stack([...])           checks none of them fight each other
          import_asset_to_project(...)    unpacks into Assets/, demos stripped

Every result is something you own or can claim free — nothing is invented.

Typing a description, not a name — none of those results share a word with the query.

Why Quartermaster? A quartermaster's job was never remembering what's in stores — it's making sure you're equipped when it's time to move. That's nearer the real problem than forgetting is. I hadn't lost anything; I knew I owned stuff. What I couldn't do was get from "I want to prototype a dam" to "open these four packages" without an hour of digging first — and maybe more if it worked out doesn't survive an hour of digging. Ideas that arrive that way don't get rejected. They just quietly don't happen, and you never find out whether they would have.

What it indexes

Everything lands in one SQLite table behind one search surface, so a query crosses all of them at once. Nothing is engine-scoped: a Megascans surface and a Unity shader come back from the same question if they both answer it.

The part nobody tells you

Neither store will admit what you own.

Unity removed /account/purchases (404 since August 2026). Fab has no ownership API, no export button, nothing. Your purchase history exists only inside their private GraphQL, behind SSO, MFA, and bot detection.

Getting at it took four attempts, three of them failures:

1. Playwright's bundled Chromium — Epic's captcha refuses it outright ("enable JavaScript").
2. Playwright driving your real browser — injects detectable hooks; Epic throws a second security wall after the password.
3. Debugger attached during sign-in — same result. Anything touching the login flow gets flagged.
4. What actually works: stop automating the sign-in entirely. You log in through an ordinary browser window — no debug port, nothing between you and the store — because the automation was itself what tripped the risk systems. Only after you're done, on a session you established yourself, does Quartermaster attach a debugger and replay the store's own paginated queries — with its own CSRF headers, its own chunking (42 IDs per request, because that's what Unity's client sends).

That trick is most of this project. The rest — search, linting, unpacking — is honestly straightforward by comparison.

Two hard-won rules baked into the design, if you ever hack on this yourself:

• Browsers must close gracefully (taskkill without /F). An abrupt kill loses Unity's device-trust cookie and you'll get MFA-challenged on every future session.
• Never run a library fetch headless. Headless triggers Unity's risk system even with valid cookies.

Quixel Megascans, and why your Fab library looks short

Fab's library view and the Megascans catalog are not the same list, and there is no export that reconciles them — you can hold rights to far more Megascans content than your library page displays. Whatever the cause, the practical result is the same: scrolling and hand-searching for something you already have.

Quartermaster sidesteps it. It syncs the Quixel Megascans and Quixel Megaplants seller catalogs from Fab directly — 5,580 listings as of this writing — independently of what your library view shows, and files them next to everything else you own, tagged by status:

• vault_owned — in your library
• catalog_grant — claimable free under the Epic Content License, not yet acquired

Both are searchable, and every result says which it is, so an agent can tell "you own this" from "you can have this for nothing" without guessing.

Megascans rows also carry their physical specs where the listing publishes them — texel density, scan area, and the map list (basecolor, normal, displacement, cavity, AO, roughness…). That is the difference between an agent telling you it found a rock and an agent telling you it found a 1×1 m scan at 8192 px/m with displacement — which is the part that decides whether it's usable.

python -m src.store_client sync-quixel      # catalog
python -m src.store_client enrich-quixel    # texel density, scan area, maps

What you get

Search that understands intent & vision. This is the dam problem.

• Exact keywords via SQLite FTS5.
• Natural language intent via local ONNX text embeddings (BAAI/bge-small-en-v1.5) — "concrete structures for holding back water" surfaces meshes and shaders whose listings never mention dams.
• Cross-modal visual understanding via ONNX CLIP embeddings (Qdrant/clip-ViT-B-32) — searching "gothic cathedral" literally scores your screenshots and promo renders, finding assets even when their text descriptions are completely silent. A visual hit also hands back which screenshot matched, not just the cover art.
• Every result shows its working. Each hit carries a match field — keyword, semantic+vision, keyword+semantic+vision — so you and your agent can see which signal fired. A pure-vision hit on a listing with useless marketing copy is a different kind of result than an exact title match, and it should be legible as one.
• Concept tags mined from screenshots. The offline vision pass scores every gallery image against a visual vocabulary and writes the survivors back into the FTS index, so "medieval village" and "dark horror atmosphere" become keyword-searchable on assets whose descriptions never said either. The vocabulary is a JSON file you can replace — see docs/concepts.md. All three signals are fused with 3-way Reciprocal Rank Fusion (RRF) on your CPU. No GPU, no vector database process, no cloud API — ONNX Runtime and a numpy matrix, in the same process as everything else.

Measured on a ~7,500-asset vault: ~520 MB peak RAM with both models resident, ~1.4 s for the first query (loading BGE and CLIP), ~85 ms warm after that. The models load lazily, so an agent that never searches never pays for them.