Y Combinator Open-Sources QM: An MIT-Licensed Multiplayer Agent Harness That Runs In Slack And The Web

Y Combinator team has open-sourced QM (quartermaster), the multi-agent harness it uses internally. QM is described as a multiplayer agent harness for work, running in Slack and on the web. YC team runs QM across accounting, legal, events, and engineering, including building QM itself. The whole project ships under the MIT license. YC frames the release as an experiment that is early and has bugs.

Is QM Deployable

Yes. QM is deployable today, but it is org software, not a desktop app. Deployment assumes a cloud account, Postgres, and someone comfortable with infrastructure. The best fit is a startup or mid-sized company, roughly 10 to 500 people, with at least one platform engineer. Larger enterprises can run it, but should review the security posture first.

Realistic industries include venture and professional services, fintech and accounting operations, legal operations, events, and B2B SaaS internal tooling. Applications named in the repository include searching internal notes, email, documents, databases, and the web together; triaging an inbox on a schedule with labels and reply drafts; working in an existing repository to run tests, open PRs, and monitor CI; and tracking a project in a shared channel.

Deploying QM does not require cloning the repository. An org-owned deployment repo depends on @yc-software/qm, then runs qm init with an org slug and a Fly.io or AWS target. Initialization materializes a deployment skill that walks through infrastructure, web sign-in, connectors, optional Slack access, and live verification. Sign-in defaults to a built-in broker that emails a one-time link, and an external identity provider can replace it. Each deployment runs in the operator’s own cloud account, and initialization does not create deployment CI. Teams that want core and customizations in one tree keep a private fork made by a plain clone, never GitHub’s Fork button. Details are in deployment.md and getting-started.md.

What is QM

Most agents are designed as personal assistants. The YC team argues that stretching one assistant across a whole company gets complex quickly. QM instead gives each employee an isolated workspace that others cannot affect. People also collaborate with the agent in channels, group messages, and projects.

Each person and each room gets its own scoped memory, files, keychain view, permissions, crons, web apps, and durable sandbox. The same identity and configuration carries between Slack and the web app. Skills are scope-owned and shareable by grant, with admin-gated promotion to the whole org. Skill packs can be imported from git repositories. Crons and watches run background work unattended.

Architecture

Every turn runs through a central headless core. The core handles API, identity, policy, and scheduling, and drives an agent loop. A Postgres layer holds user data, session history, and other durable state. The agent has a small, fixed tool surface. One of those tools is execute, which runs commands in the scope’s own isolated sandbox, where installed tools stay installed.

QM is harness-agnostic. Pi, OpenCode, Codex, and Claude Code all drive the same core, so a deployment is not tied to one vendor. The core runs TypeScript directly on Node and uses Fastify for HTTP. The Slack plugin uses Bolt; the web UI builds with Vite and renders with Lit. The web UI, admin panel, and public portal are optional plugins over the core’s HTTP API.

Security Model

QM follows the pattern of local coding agents. The agent acts as the person it works for, with their credentials and permissions, and everything is audited. An org picks one posture, which narrower scopes can only tighten. Strict pauses every harness tool call for human approval, except two no-effect turn enders. Auto, the default, screens provenance-labelled external data and tool results with a classifier before they reach the model. A deployment can point that classifier at its own screening proxy. Dangerous removes content screening and pauses. A predeclared command policy, with hard denials for things like recursive deletes and destructive SQL, applies in every posture including Dangerous. The threat model and known limitations are in SECURITY.md.

Key Takeaways

• YC open-sourced QM under an MIT license, for Slack and web.
• Every person and every room gets isolated memory, files, keychain view, permissions, crons, and sandbox.
• Pi, OpenCode, Codex, and Claude Code all drive the same core, so deployments avoid vendor lock-in.
• Three org security postures gate tool calls, and destructive-command denials apply in all three.
• YC runs it across accounting, legal, events, and engineering, and calls it early and buggy.

Check out the GitHub Repo and Project Page. Feel free to check out our GitHub Page for Tutorials, Codes and Notebooks. Also, feel free to follow us on Twitter and don’t forget to join our 100k+ ML SubReddit and Subscribe to our Newsletter.