Y Combinator Launches QM, an Open-Source Multiplayer AI Agent Harness for Workplace Collaboration

Y Combinator has launched QM, an open-source multiplayer AI agent harness designed to let startup teams run autonomous agents across Slack and the web. Built primarily in TypeScript under the MIT License, the platform provides each employee with an isolated sandbox workspace while allowing collaborative execution. Users can drive the system using multiple underlying model harnesses, including Claude Code, Codex, and OpenCode.

Scoped Workspaces for Collaborative AI

Most artificial intelligence agents operate as personal assistants, which can make enterprise-wide integration complex and difficult to manage. QM addresses this by tailoring its environment to startup operations. Instead of sharing a single, unsegmented instance, individual employees receive their own isolated workspaces where they can work independently without affecting their colleagues.

At the same time, the platform supports multi-user collaboration. Teams can interact with the agent collectively inside shared channels, group direct messages, and specific projects. Within this framework, the platform relies on personal and shared scopes:

• Personal and shared scopes: Users can customize the agent to be theirs, while still working with it collaboratively in Slack channels and group projects.
• Unified interface: The same user identity and configuration carry seamlessly between Slack and the companion web application.
• Admin control: Administrators can set organization-level configurations, dictate a global security posture, and manage which harnesses and models are available to users.
• Custom web apps: Teams can spin up custom internal web applications and publish them directly to designated teams or roles.
• Shared skills: Skills are owned at the scope level and can be shared via specific grants, with admin-gated promotion to the entire organization, or imported as skill packs directly from Git repositories.
• Background automation: Built-in crons and file-watching utilities execute processes in the background when no users are actively watching.

Modular, Vendor-Agnostic Architecture

According to the repository’s language breakdown, the QM codebase is 92% TypeScript, with the remainder consisting of HTML (5%), CSS (1%), and minor configuration files. The system architecture splits operations into a headless core, a persistent database layer, and isolated, per-scope sandboxes.

The headless core runs TypeScript directly on Node and utilizes the Fastify framework to expose its HTTP API. This core handles identity management, security policies, task scheduling, and the primary agent loop. Behind this core sits a Postgres database that persists user sessions, scoped memories, and task queues.

A central design choice of QM is its modular driver interface. Rather than locking a deployment to a single model provider, the system remains vendor-agnostic. Multiple underlying model harnesses—including Pi, OpenCode, Codex, and Claude Code—can drive the same core API. This design allows organizations to switch between model providers without altering the core deployment structure.

To interact with its environment, the agent utilizes a small, fixed set of tools. Its primary operational tool is execute, which runs commands inside an isolated, per-scope sandbox. This sandbox acts as a durable virtual computer, meaning any packages, configurations, or command-line utilities installed by the agent during a session persist for future tasks.

User interaction occurs through optional plugins sitting over the core HTTP API. The web user interface is built with Vite and rendered using Lit, while the admin panel and public portal operate as distinct HTTP plugins. For Slack integrations, an in-process plugin built on Slack’s Bolt framework is managed directly by the core.

Automated Tasks and Codebase Integration

By combining scoped sandboxes with external tool access, QM executes a variety of operational and engineering workflows. For standard operational tasks, the agent can:

• Search internal notes, emails, documents, databases, and the web simultaneously to retrieve consolidated information.
• Extract data from a company’s shared knowledge base.
• Spin up custom, internal web apps, publish them to designated teams, and maintain up-to-date underlying datasets.
• Analyze historical sent messages to mimic a user’s writing voice, allowing it to triage email inboxes on a schedule, complete with draft replies and labels.

In engineering workflows, QM can run directly within an existing software repository to:

• Run test suites
• Open pull requests
• Monitor continuous integration (CI) pipelines
• Inspect system and application logs
• Track project progress inside a shared Slack channel to post updates and follow-ups

Granular Security Control and Postures

Because the agent operates using the credentials and permissions of the user it is currently assisting, security is tightly integrated into the platform’s design. Every action taken by the agent is fully audited. During deployment, an organization configures a global security posture, which narrower, individual scopes can further tighten but cannot loosen.

The platform supports three distinct security configurations:

• Strict: Every harness tool call initiated by the agent pauses and waits for manual human approval before execution, with the exception of two no-effect actions that end the agent’s turn.
• Auto (Default): An automated classifier screens external data and tool results before they reach the language model. Deployments can point this classifier at an organization’s own screening proxy.
• Dangerous: Content screening is fully disabled, and the agent executes tool calls in succession without pausing for human approval.

A predeclared command policy is enforced globally across all three postures, including the Dangerous mode. This policy applies hard denials and approval rules for destructive actions, such as recursive file deletions or destructive SQL queries.

Initialization and Cloud Infrastructure Setup

Deploying QM requires creating an organization-owned deployment repository that depends on @yc-software/qm. Every deployment runs entirely within the operator’s own cloud account, supporting targets like Amazon Web Services (AWS) or Fly.io.

The deployment process is initialized without requiring a local source checkout of the QM repository itself. Operators run the initialization process using the qm command-line interface (CLI) with the following commands:

npm exec --yes --package=@yc-software/qm@latest -- \
  qm init . --org <slug> --target <fly-or-aws>
npm install

This initialization command materializes a deployment skill for the agent and guides the operator through a series of setup steps:

1. Configuring cloud infrastructure
2. Setting up web sign-in and user authentication
3. Establishing connector credentials
4. Enabling optional Slack access
5. Running deployment and live verification

The initialization process does not generate or enable a deployment continuous integration (CI) workflow, and the upstream repository contains no production deployment workflows. Operators are responsible for establishing their own deployment CI pipelines if desired.

Maintaining Upstream Alignment via Private Forks

For organizations that want to customize their agents while keeping proprietary code private, QM supports a structured “private fork” workflow. This approach avoids using GitHub’s built-in fork feature, which inherits the visibility of the source repository and prevents a public repository from being forked privately.

Instead, operators establish a plain, standalone private repository that mirrors the upstream codebase:

gh repo create <org>/qm-private --private

git clone --bare git@github.com:yc-software/qm qm-seed.git
git -C qm-seed.git push --mirror git@github.com:<org>/qm-private
rm -rf qm-seed.git

git clone git@github.com:<org>/qm-private
git -C qm-private remote add upstream git@github.com:yc-software/qm

To keep the core system byte-identical to the upstream public repository—ensuring merges remain small—all organization-specific configurations, sandbox tools, plugin images, and infrastructure definitions are isolated inside a dedicated subdirectory located at deploy/layers/<org>/.

To manage this boundary, the repository utilizes two specialized skills:

• update-qm: Merges upstream updates from the public QM repository into the private fork and automatically opens a synchronization pull request.
• upstream-pr: Packages generic, organization-agnostic fixes to send back to the public repository. Instead of stripping commit histories or screenshots, this skill cuts a branch from upstream/main and checks the outgoing diff, commit messages, and screenshots for any organization-specific identifiers before pushing the code.

No code located under the deploy/layers/ directory is ever pushed upstream.

Repository Metrics and Contribution Guidelines

Since its creation on July 29, 2026, the QM repository has accumulated 6,660 stars, 703 forks, and 27 watchers, with 82 open issues remaining. The project is actively maintained, with its latest release, version 0.1.4, published on July 31, 2026. This minor update introduced two changes:

• Restricting the web-ui model picker to the organization’s allowed-models list.
• Using @latest in the qm initialization bootstrapping instead of a version placeholder.

The project enforces a distinctive contribution model that does not accept direct code pull requests from external contributors. Instead, contributors must describe their proposed changes informally as human-written text in either a .txt or .md file inside the adrs/ (Architectural Decision Records) directory. If the maintainers align with the proposed change, they handle the internal code implementation. Vulnerability reports must be submitted privately in accordance with the project’s security policy, rather than through public issues.

---

Source: View on GitHub