# QM

> An open-source multiplayer agent harness for startups that gives every employee and project their own isolated AI agent workspace, accessible via Slack and the web.

QM is an open-source multiplayer agent harness built by Y Combinator and released in July 2026 under the MIT License. It is designed for startups that want to deploy a fleet of AI agents — one per employee and per project — without the complexity of managing individual personal assistants at scale. The code lives at github.com/yc-software/qm and questions can be directed to labs@ycombinator.com.

## What It Is

QM (short for "quartermaster") is a self-hosted agent harness that gives every person and every room in an organization their own scoped AI workspace. Unlike personal-assistant-style agents, QM is built for collaborative, multi-user environments: each employee gets isolated memory, files, a keychain view, permissions, crons, web apps, and a durable sandbox, while still being able to work with the agent in shared Slack channels, group messages, and projects. The harness is model-agnostic — Pi, OpenCode, Codex, and Claude Code can all drive the same core, so a deployment is not locked to any single vendor.

## Architecture and Deployment Model

QM's architecture centers on a headless TypeScript core running on Node with Fastify for HTTP. A Postgres persistence layer holds user data, session history, and durable state. The agent has a small, fixed tool surface; one of those tools is `execute`, which runs commands in each scope's own isolated sandbox. The web UI, admin panel, and public portal are optional plugins over the core's HTTP API; Slack is an optional in-process plugin supervised through a direct service client.

Deployment is handled through an organization-owned deployment repository that depends on `@yc-software/qm`. The `qm` CLI validates and deploys a "deployment directory" that carries all org-specific config, custom tools and skills, sandbox image, and infrastructure. Every substrate — harness, session store, sandbox, memory — sits behind an interface, so production implementations swap in via one wiring file. Each deployment runs in the operator's own cloud account.

## Security Posture

QM follows the same security model as local coding agents like OpenCode, Codex, and Claude Code: the agent acts as the person it's working for, with their credentials and permissions, and everything it does is audited. Three postures are available:

- **Strict** — every harness tool call pauses for human approval, except the two no-effect turn enders.
- **Auto** (default) — a classifier screens provenance-labelled external data and tool results before they reach the model; a deployment can point that at its own screening proxy.
- **Dangerous** — no content screening, no pauses between tool calls.

A predeclared command policy — approval rules and hard denials for things like recursive deletes or destructive SQL — applies in every posture, including Dangerous.

## Key Capabilities

- Personal and shared scopes: employees customize the agent individually and collaborate in Slack channels and projects
- Slack and web: the same identity and configuration carries between both surfaces
- Admin control: org-level configuration, security posture, and harness/model availability
- Web apps: spin up custom internal apps and publish them to the right people
- Shared skills: scope-owned and shareable by grant, with admin-gated promotion to the whole org and skill packs imported from git repositories
- Background work: crons and watches run work while nobody's watching

## Origin and Open-Source Lineage

The homepage describes QM as the result of YC's internal experimentation with several agent harnesses. The first was a basic agent loop in Ruby with tools that could access internal data. YC later provisioned over 50 Hermes agents for individual employees as personal assistants, but managing a fleet of that size became challenging. QM was built to be as flexible as Hermes but with the simplicity of the original system, and to be fully self-hostable. YC states it wanted to own and host the system itself and to contribute to the open-source ecosystem.

## Update: v0.1.4

QM was publicly released on July 29, 2026, and reached v0.1.4 by July 31, 2026. The repository had accumulated 1,940 stars and 177 forks within days of launch, reflecting rapid early community interest. The project accepts contributions as human-written text (descriptions of desired changes in `.txt` or `.md` files) rather than code pull requests, with the maintainers handling implementation.

## Features
- Personal and shared agent scopes per employee and project
- Slack and web UI with shared identity and configuration
- Admin control over org-level config, security posture, and model availability
- Model-agnostic: supports Pi, OpenCode, Codex, and Claude Code
- Per-scope isolated sandbox with durable files and tools
- Shared skills with grant-based sharing and admin-gated org promotion
- Skill packs importable from git repositories
- Background work via crons and watches
- Custom internal web apps publishable to specific people
- Keychain and secrets management per scope
- Three security postures: Strict, Auto, and Dangerous
- Predeclared command policy with approval rules and hard denials
- Postgres-backed session history and durable state
- CLI for deployment directory validation and deployment
- Private fork support for full-codebase customization

## Integrations
Slack, Postgres, Fly.io, AWS, OpenCode, Codex, Claude Code, Pi, Vite, Lit, Fastify, Node.js, npm

## Platforms
WEB, CLI, API

## Pricing
Open Source

## Version
v0.1.4

## Links
- Website: https://qm.ycombinator.com
- Documentation: https://github.com/yc-software/qm/blob/main/docs/getting-started.md
- Repository: https://github.com/yc-software/qm
- EveryDev.ai: https://www.everydev.ai/tools/qm-agent-harness