QMD (Quick Markdown Search) is a local-first, on-device hybrid search engine for markdown files, built as a CLI tool, a TypeScript SDK, and an MCP (Model Context Protocol) server. It indexes markdown documents and supports BM25 full-text search via SQLite FTS5, vector semantic search via sqlite-vec, LLM-based query expansion (using a fine-tuned Qwen3-1.7B model), and cross-encoder reranking. The architecture is a monolithic TypeScript module with clear separation of concerns: a core store layer handling indexing and retrieval, a config-driven collection system with YAML-based index definitions, a trust-gated security model for project-local configurations, and output formatters supporting JSON, CSV, Markdown, and XML. The project also includes a fine-tuning pipeline (Python-based SFT, GRPO) to train the query expansion model, with curated training data and evaluation benchmarks. The repository has a hybrid character: while its primary output is a production-ready application (CLI + MCP server), it contains a substantial data-research component in the `finetune/` directory with training scripts, dataset generation, reward functions, and model evaluation harnesses. The fine-tuning pipeline is tightly coupled to the main application's query expansion feature, making this more than a simple add-on – it is integral to the search quality. The code demonstrates strong engineering practices: content-addressable storage for deduplication, AST-aware chunking for code files, reciprocal rank fusion for multi-signal search, and a cross-runtime SQLite abstraction that runs on both Node.js and Bun. The project is actively maintained with CI/CD on GitHub Actions, Nix flake builds, and npm publishing. Key entry points include `src/cli/qmd.ts` (CLI dispatcher), `src/store.ts` (core data layer), `src/mcp/server.ts` (MCP server), and `finetune/train.py` (training pipeline). The system is designed for personal knowledge management and AI agent integration, offering a `qmd search` command for quick lookups and an MCP server exposing tools like `query`, `get`, and `multi_get` for agent consumption. Security is a first-class concern: project-local configs that declare hooks or out-of-project paths require explicit trust approval via a digest-based store, and the HTTP MCP server includes DNS-rebinding protection.