Y Combinator Open-Sources QM: An MIT-Licensed Multiplayer Agent Harness That Runs In Slack And The Internet

Y Combinator group has open-sourced QM (quartermaster), the multi-agent harness it makes use of internally. QM is described as a multiplayer agent harness for work, operating in Slack and on the internet. YC group runs QM throughout accounting, authorized, occasions, and engineering, together with constructing QM itself. The entire challenge ships underneath the MIT license. YC frames the discharge as an experiment that’s early and has bugs.

Is QM Deployable

Sure. QM is deployable right this moment, however it’s org software program, not a desktop app. Deployment assumes a cloud account, Postgres, and somebody snug with infrastructure. The very best match is a startup or mid-sized firm, roughly 10 to 500 folks, with a minimum of one platform engineer. Bigger enterprises can run it, however ought to overview the safety posture first.

Real looking industries embrace enterprise {and professional} companies, fintech and accounting operations, authorized operations, occasions, and B2B SaaS inside tooling. Purposes named within the repository embrace looking out inside notes, e mail, paperwork, databases, and the net collectively; triaging an inbox on a schedule with labels and reply drafts; working in an current repository to run checks, open PRs, and monitor CI; and monitoring a challenge in a shared channel.

Deploying QM doesn’t require cloning the repository. An org-owned deployment repo depends upon @yc-software/qm, then runs qm init with an org slug and a Fly.io or AWS goal. Initialization materializes a deployment ability that walks via infrastructure, net sign-in, connectors, optionally available Slack entry, and dwell verification. Signal-in defaults to a built-in dealer that emails a one-time hyperlink, and an exterior identification supplier can exchange it. Every deployment runs within the operator’s personal cloud account, and initialization doesn’t create deployment CI. Groups that need core and customizations in a single tree maintain a non-public fork made by a plain clone, by no means GitHub’s Fork button. Particulars are in deployment.md and getting-started.md.

What’s QM

Most brokers are designed as private assistants. The YC group argues that stretching one assistant throughout an entire firm will get complicated rapidly. QM as a substitute offers every worker an remoted workspace that others can not have an effect on. Individuals additionally collaborate with the agent in channels, group messages, and initiatives.

Every particular person and every room will get its personal scoped reminiscence, recordsdata, keychain view, permissions, crons, net apps, and sturdy sandbox. The identical identification and configuration carries between Slack and the net app. Abilities are scope-owned and shareable by grant, with admin-gated promotion to the entire org. Talent packs could be imported from git repositories. Crons and watches run background work unattended.

Structure

Each flip runs via a central headless core. The core handles API, identification, coverage, and scheduling, and drives an agent loop. A Postgres layer holds person information, session historical past, and different sturdy state. The agent has a small, mounted device floor. A type of instruments is execute, which runs instructions within the scope’s personal remoted sandbox, the place put in instruments keep put in.

QM is harness-agnostic. Pi, OpenCode, Codex, and Claude Code all drive the identical core, so a deployment just isn’t tied to at least one vendor. The core runs TypeScript straight on Node and makes use of Fastify for HTTP. The Slack plugin makes use of Bolt; the net UI builds with Vite and renders with Lit. The net UI, admin panel, and public portal are optionally available plugins over the core’s HTTP API.

Safety Mannequin

QM follows the sample of native coding brokers. The agent acts because the particular person it really works for, with their credentials and permissions, and every thing is audited. An org picks one posture, which narrower scopes can solely tighten. Strict pauses each harness device name for human approval, besides two no-effect flip enders. Auto, the default, screens provenance-labelled exterior information and power outcomes with a classifier earlier than they attain the mannequin. A deployment can level that classifier at its personal screening proxy. Harmful removes content material screening and pauses. A predeclared command coverage, with onerous denials for issues like recursive deletes and damaging SQL, applies in each posture together with Harmful. The risk mannequin and identified limitations are in SECURITY.md.

Key Takeaways

• YC open-sourced QM underneath an MIT license, for Slack and net.
• Each particular person and each room will get remoted reminiscence, recordsdata, keychain view, permissions, crons, and sandbox.
• Pi, OpenCode, Codex, and Claude Code all drive the identical core, so deployments keep away from vendor lock-in.
• Three org safety postures gate device calls, and destructive-command denials apply in all three.
• YC runs it throughout accounting, authorized, occasions, and engineering, and calls it early and buggy.

Try the GitHub Repo and Venture Web page. Be happy to take a look at our GitHub Web page for Tutorials, Codes and Notebooks. Additionally, be at liberty to observe us on Twitter and don’t neglect to affix our 100k+ ML SubReddit and Subscribe to our E-newsletter.