Preface¶

On July 31, 2026, Y Combinator announced the open-sourcing of QM (Multiplayer Agent Harness) on X. This is a multi-agent collaboration framework that has been running internally at YC for several months. The repository is located at github.com/yc-software/qm, licensed under MIT License, with its official website at qm.ycombinator.com. Right after the announcement, QM topped the Hacker News rankings on its first day, garnering over 500 upvotes and discussions.

If you have been following open-source Agent Harness projects like OpenClaw and Hermes Agent recently, QM has a very different positioning: it is not a “more powerful personal assistant”, but treats Agents as company-level infrastructure — every employee, every Slack channel/project room can have isolated memory, files, permissions and sandboxes, and collaborate with the same identity across Slack and the Web.

YC officials stated that QM has been used by accounting, legal, event and engineering teams, including its own development; it also emphasized that the project is still an early experiment, “has bugs, but is already quite useful for us”. Based on the official README, deployment documentation and public discussions, this article sorts out what QM is, its architecture, how it differs from existing Harnesses, and how teams can get started with it.

What is QM¶

The first paragraph of the official README clearly defines its boundaries:

Most agents are designed like personal assistants. QM is designed for startups.

Translated: Most agents are built like personal assistants; QM is built for startups/organizations. Each employee has an independent Agent workspace that does not interfere with others; at the same time, they can collaborate with Agents and human colleagues in Slack channels, group chats and shared projects.

QM is not a chatbot wrapper, but a complete Multiplayer Agent Harness (multi-agent runtime). Its core capabilities include:
1. Personal and shared scopes — Employees can customize their “personal Agent”, and also use it collaboratively in channels/projects.
2. Slack + Web dual interface — Switch between Slack and Web UI with the same identity and configuration.
3. Organization-level governance — Administrators configure security policies, available Harnesses and models.
4. Publish internal Web Apps — Quickly build small internal applications for specific groups of people.
5. Shared Skills — Authorize by scope, support importing Skill Packs from Git repositories.
6. Background tasks — Cron and Watch run continuously when unattended.

Every “person” and every “room” has independent scoped resources: memory, files, Keychain view, permissions, Cron, Web Apps, persistent sandboxes. This is completely different from the model of “using one shared Bot account for the entire company”.

Architecture Overview¶

QM adopts a cloud-first, self-hostable design. The simplified official architecture diagram is as follows:
- Headless Core: TypeScript + Node.js + Fastify, responsible for API, identity, policies and scheduling.
- Agent Loop: Can connect to multiple Harnesses such as Pi, OpenCode, Codex, Claude Code, driving the same core to avoid vendor lock-in.
- Postgres: Persist session, memory, queue and other states.
- Per-scope Sandbox: Each scope has an independent sandbox; Agents execute commands in the sandbox through the execute tool in the fixed tool surface, and installed tools can be retained persistently.
- Plugin Layer: Slack (Bolt), Web UI (Vite + Lit), Admin, Portal, etc., connected to the Core via HTTP API.

The official emphasizes that the Core itself is general-purpose; organization-specific configurations, custom tools/Skills, sandbox images and infrastructure are all placed in the deployment directory, which is verified and deployed by the qm CLI. All underlying implementations (Harness, Session Store, Sandbox, Memory) are abstracted through interfaces, and production environments can be replaced in a single wiring file.

The technology stack is friendly to teams familiar with Node/TypeScript; the main operational requirements are Postgres + your own cloud account (the official CLI supports targets such as Fly.io or AWS).

Positioning Differences from OpenClaw and Hermes¶

The Agent Harness track has clearly differentiated in 2026. OpenClaw and Hermes are often discussed together in the community, but their focus is still on individuals or small teams:

OpenClaw is more focused on “multi-channel orchestration and control plane” — connecting Agents to existing touchpoints such as Slack and WhatsApp; Hermes Agent (Nous Research) emphasizes persistent memory and closed-loop self-written Skills after tasks. Both have matured in the “one person, one machine, one message link” scenario.

QM fills another gap: when Agents change from “my assistant” to “our company’s operating system”, identity isolation, room-level permissions, organizational policies and auditable sandboxes are needed. YC also listed QM alongside Hermes and OpenClaw in its launch announcement, stating that it is similar in customizability but targets the entire company.

In the HN discussion, some developers pointed out that “the hardest part of multi-agent systems is often not the Agent Loop, but scoping” — QM’s per-person scopes + shared rooms is exactly an engineering solution to this problem.

What It Can Do: Scenarios Provided by YC¶

Typical use cases listed in the README include:
- Unified retrieval of internal notes, emails, documents, databases and the Web
- Pulling information from “company brain” connectors
- Building internal apps and publishing them to specific groups while keeping data updated
- Learning writing styles and then automating inbox processing (tagging, drafting replies)
- Running tests, opening PRs, monitoring CI, checking logs in existing code repositories
- Tracking projects in shared channels and following up automatically

The common feature of these scenarios is: cross-person, cross-channel, requiring long-term state — which is exactly where individual Harness extensions are most likely to stumble.

Getting Started with Deployment¶

QM does not require cloning the source code first. The official recommendation is to initialize in a deployment repository owned by your organization:

npm exec --yes --package=@yc-software/qm@latest -- \
  qm init . --org <slug> --target <fly-or-aws>
npm install

The qm init command will generate deployment Skills, guide you through infrastructure setup, Web login, connector credentials, optional Slack integration, deployment and online verification. Every deployment runs in the operator’s own cloud account; initialization will not automatically enable CI, and the upstream repository has no production deployment workflow. For details, see deployment.md and docs/getting-started.md in the repository.

If your team wants to fork the entire repository privately (for engineers and Coding Agents to read the Core and custom layers together), the official documentation provides a process using gh repo create + bare clone mirror, and specifically reminds: Do not use GitHub’s Fork button — a fork from a public repository cannot be made private, and its object network is shared with the upstream; you should use a plain clone to create an independent private repository, then merge upstream changes via the upstream remote.

YC also gave a “lazy deployment” tip in its LinkedIn announcement: you can tell any Coding Agent to “deploy https://github.com/yc-software/qm” (remove the square brackets), and the Agent will help walk through the process — this aligns with QM’s design of “Harness-agnostic, Agent-driven deployment”.

Security and Permission Model¶

QM’s security approach is similar to local Coding Agents (OpenCode, Codex, Claude Code): Agents act on behalf of the user they serve, using their credentials and permissions, and their actions are auditable. The organization selects a Security Posture, and sub-scopes can only impose stricter, not looser, restrictions:

Regardless of the policy, pre-declared command policies (such as hard rejection of recursive deletion, destructive SQL) always take effect. The complete threat model is available in SECURITY.md.

For teams preparing for production, it is recommended to clarify during the PoC phase: which scopes are allowed to write to repositories, which are read-only, and which channels can trigger Cron/Webhooks — QM provides the mechanisms, but the boundaries still need to be defined by the organization itself.

Contribution Method: A Notable Detail¶

QM’s contribution guidelines differ from most open-source projects: the official CONTRIBUTING.md states that contributions are mainly in human-written text (.txt / .md files placed in adrs/), which will be aligned and implemented by the maintainers, rather than directly submitting PRs to modify the Core. Vulnerabilities should be reported privately. This reflects YC’s strict control over Core consistency and the boundaries of private deployment layers.

Look at It Calmly: An Early Experiment, Not a Finished SaaS¶

Be sure to read YC’s original statement: QM is an experiment, early and has bugs. The number of GitHub stars rose rapidly after open-sourcing (the public page shows thousands), and the community enthusiasm is high, but that does not mean it is production-ready.

Third-party reviews also pointed out that: the README is more like a product narrative, the specific enforcement of sandbox isolation, the division of labor strategy when four Harnesses coexist, and the operational burden for small teams still need to be verified in actual deployments. The YC employee’s statement on X that “small team output is like an army” is a vision statement and should not be treated as a reproducible quantitative commitment.

A more pragmatic path for founding teams might be:
1. Run a PoC in 1–2 read-only or low-risk scenarios (such as internal document Q&A, CI status broadcast);
2. Trial run under the Auto policy and observe the approval and screening costs;
3. Then gradually open shared channels and operational Skills with write permissions.

Summary¶

QM pushes the 2026 Agent competition from “whose model is stronger” to “whose organization can deploy and run it well”: MIT open-source, pluggable Harnesses, native Slack/Web support, independent sandboxes and state per person per room. It is not a direct replacement for OpenClaw/Hermes, but covers the layer of company-level Multiplayer.

If you are already using Claude Code or Codex for personal automation, QM provides a reference implementation for elevating the same capabilities to organizational infrastructure — and it comes from real internal usage at YC itself. The repository, documentation and HN discussion links are as follows. It is recommended to read the README and SECURITY.md first before deciding whether to fork:
- Repository: github.com/yc-software/qm
- Official Website: qm.ycombinator.com
- HN Discussion: news.ycombinator.com/item?id=49126604

The next battlefield for Agent Harness is likely between “individual” and “organization” — QM is YC’s open-source bet on the latter.