# QM — Y Combinator open-sources the multi-agent harness it runs internally

> Y Combinator's in-house multi-agent harness, now open-sourced under MIT — one core, four backends, Slack + web from day one.

- Org: Y Combinator
- Date: 2026-07-31
- Category: repo, tool
- Source: https://github.com/yc-software/qm
- Canonical page: https://ai-tldr.dev/releases/y-combinator-qm-agent-harness/

## In short

QM is an MIT-licensed multiplayer agent harness Y Combinator built for its own staff, released July 31, 2026. Each employee gets a scoped Slack + web workspace and can swap between Pi, OpenCode, Codex, and Claude Code without vendor lock-in.

## What it is

QM is a self-hostable agent harness that Y Combinator built for its own accounting, legal, events, and engineering teams and released under MIT on July 31, 2026. It gives every employee a personal, scoped agent workspace that also shows up as a collaborator in Slack channels and projects — the same identity across both surfaces.

## How it works

A generic TypeScript core (Node + Fastify + Postgres) runs the agent loop through pluggable model backends — Pi, OpenCode, Codex, or Claude Code all drive the same loop. Each user and each Slack room has its own scoped memory, files, keychain view, permissions, crons, and durable sandbox. A small fixed tool surface includes an `execute` tool that runs commands in that scope's sandbox, so installed packages persist between turns.

## Why it matters

Most open agent harnesses ship a single-user experience; QM is one of the first to treat multi-tenant company deployment as the primary case, with admin controls, three security postures (Strict / Auto / Dangerous), and shared skills as first-class features. That fills a gap for startups that want internal agents but don't want to build the orchestration, sandbox, and Slack plumbing themselves.

## Who it's for

Startup engineering and ops teams building internal AI tooling on their own infrastructure.

## Try it

npm exec --yes --package=@yc-software/qm@latest -- qm init . --org <slug> --target <fly-or-aws>

## Quick facts

- Maker: Y Combinator
- License: MIT
- Language: TypeScript (Node + Fastify + Postgres)
- Supported harnesses: Pi, OpenCode, Codex, Claude Code
- Interfaces: Slack + web app
- Security postures: Strict, Auto, Dangerous
- Install: npm exec --package=@yc-software/qm@latest -- qm init

## FAQ

### What does QM stand for?

QM is short for quartermaster, the naval role responsible for coordination and keeping order belowdecks. Y Combinator picked the name because QM does the same thing for a company's agents: each person and channel gets its own scoped memory, files, keychain view, permissions, crons, and durable sandbox, coordinated through one central core.

### Which models can QM run?

QM is harness-agnostic and ships with adapters for Pi, OpenCode, Codex, and Claude Code — all four drive the same core loop, so a deployment can switch models per user or per room without changing the surrounding infrastructure. Y Combinator says this design was deliberate so no deployment gets locked into a single vendor.

### How is QM different from an existing personal agent like Claude Code?

Personal agents assume one user; QM assumes a whole company. Each employee has an isolated workspace with their own memory, files, credentials, and sandbox, but the same identity works in shared Slack channels and projects. Admins set org-level policy, a security posture, and which harnesses and models are available.

### How do I deploy QM?

QM is self-hosted in your own cloud account. Run `npm exec --yes --package=@yc-software/qm@latest -- qm init . --org <slug> --target <fly-or-aws>` and the CLI scaffolds an org-owned deployment repository, provisions Postgres for durable state, and optionally wires up the Slack plugin. The core runs TypeScript on Node with Fastify.

### What are QM's three security postures?

QM ships with Strict (human approval required for every tool call), Auto (the default, with content screening applied), and Dangerous (no screening — the agent acts freely). The agent always acts as the person it's working for, with their credentials and permissions, so posture choice determines how much human review each turn gets.

## Links

- [GitHub Repo](https://github.com/yc-software/qm)
- [QM Landing Page](https://qm.ycombinator.com)
- [Hacker News Discussion](https://news.ycombinator.com/item?id=49126604)
- [StartupHub Coverage](https://www.startuphub.ai/ai-news/artificial-intelligence/2026/yc-qm-agent-harness-a-collaborative-ai-shift)