Tanshaydar/Quartermaster

This project started because I wanted to prototype a dam.
Nothing serious — a short demo, maybe more if it worked out. Before building anything, I wanted to see what I already owned that could speed it up. So I searched my library for "dam": nothing came back. Of course nothing came back — no asset is *called* a dam. But spread across four packages I already owned were curved concrete meshes, a water system, some rocky terrain. Everything the dam needed. I'd had most of it for years and never once connected the pieces.
That's what ~1,500 assets across two stores did to me when this started — a library that has since grown past 7,500 assets across five ecosystems. Almost all of it from bundles and sales, none of it remembered. And it's not just me — no AI assistant knows either. Ask one for help and it either builds everything from scratch or sends you shopping, while hundreds of dollars of exactly-the-right-thing sits on your disk.
Quartermaster indexes everything you own across the **Unity Asset Store**, **Fab**, **Quixel Megascans**, **Gumroad** and **Leartes Cosmos** — locally, on your machine — and serves it to your coding agent over MCP. It's the tool I wished existed that day: ask about a dam, get told you already own curved concrete meshes.
Every result is something you own or can claim free — nothing is invented.
*Typing a description, not a name — none of those results share a word with the query.*
Why *Quartermaster*? A quartermaster's job was never remembering what's in stores — it's making sure you're equipped when it's time to move. That's nearer the real problem than forgetting is. I hadn't lost anything; I knew I owned *stuff*. What I couldn't do was get from "I want to prototype a dam" to "open these four packages" without an hour of digging first — and *maybe more if it worked out* doesn't survive an hour of digging. Ideas that arrive that way don't get rejected. They just quietly don't happen, and you never find out whether they would have.
What it indexes
| Source | What comes in | How |
| :--- | :--- | :--- |
| **Unity Asset Store** | Owned packages, descriptions, gallery art | Authenticated harvest |
| **Fab** (Epic) | Owned Unreal and Unity listings | Authenticated harvest |
| **Quixel Megascans / Megaplants** | The catalog, with texel density, scan area and map lists | Public catalog sync |
| **Gumroad** | Owned products | Authenticated harvest |
| **Leartes Cosmos** | Owned and claimable Cosmos inventory, with deep screenshot galleries (18 on average, up to 71) | Authenticated harvest |
Everything lands in one SQLite table behind one search surface, so a query crosses
all of them at once. Nothing is engine-scoped: a Megascans surface and a Unity
shader come back from the same question if they both answer it.
The part nobody tells you
Neither store will admit what you own.
Unity removed /account/purchases (404 since August 2026). Fab has no ownership API, no export button, nothing. Your purchase history exists only inside their private GraphQL, behind SSO, MFA, and bot detection.
Getting at it took four attempts, three of them failures:
1. **Playwright's bundled Chromium** — Epic's captcha refuses it outright ("enable JavaScript").
2. **Playwright driving your real browser** — injects detectable hooks; Epic throws a second security wall after the password.
3. **Debugger attached during sign-in** — same result. Anything touching the login flow gets flagged.
4. **What actually works**: stop automating the sign-in entirely. You log in through an ordinary browser window — no debug port, nothing between you and the store — because the automation was itself what tripped the risk systems. Only *after* you're done, on a session you established yourself, does Quartermaster attach a debugger and replay the store's own paginated queries — with its own CSRF headers, its own chunking (42 IDs per request, because that's what Unity's client sends).
That trick is most of this project. The rest — search, linting, unpacking — is honestly straightforward by comparison.
Two hard-won rules baked into the design, if you ever hack on this yourself:
- Browsers must close *gracefully* (taskkill without /F). An abrupt kill loses Unity's device-trust cookie and you'll get MFA-challenged on every future session.