Preface¶

On July 31, 2026, Y Combinator open-sourced its internal multi-agent collaboration framework QM (Quartermaster) under the MIT License. The GitHub repository yc-software/qm gained over 10,000 stars within days. QM is positioned as multiplayer agent harness for work — not a personal chat assistant, but a corporate-grade work Agent infrastructure with native support for both Slack and web interfaces, and the ability to switch between multiple harnesses such as Pi, OpenCode, Codex, and Claude Code.

YC itself operates this system across its accounting, legal, event operations, and engineering teams (including the team that developed QM itself). The official documentation also clearly states that the project is still in its early stages, contains bugs, and is more like a public experiment. However, for teams evaluating “corporate-level Agent operating systems,” QM provides a self-hostable, forkable, commercially usable reference implementation.

This article sorts out QM’s core design, architecture, and security model based on the official README, SECURITY document, and public reports, and provides deployment resources.

What Problem Does QM Solve?¶

Most Agent products are designed as “personal assistants”: one account, one memory, one set of tools. Extending the same logic to an entire company quickly leads to issues such as permission isolation, collaborative context, and audit trail tracking.

QM’s approach is to split independent workspaces by individual user and by room (channel/project):
- Each employee has isolated memory, files, keychain view, permissions, crons, web apps, and a durable sandbox (persistent sandbox where installed tools are retained).
- The same identity can seamlessly switch between Slack channels, group chats, and web applications, with consistent configuration and context.
- Administrators unify security policies, available harnesses, and models at the organizational level, and the scope can only be narrowed, not expanded.

This differs from the “one local Claude Code per person” model: QM assumes the entire company is the operational unit, with Agents acting on behalf of employees, using their credentials and permissions, and all operations being auditable.

Core Capabilities Overview¶

According to the official README, QM currently emphasizes the following capabilities:
1. Personal and shared scopes — Coexistence of personal customization and in-channel/project collaboration.
2. Slack and web — Cross-device use with the same identity.
3. Admin control — Organizational-level configuration, security posture, and harness/model whitelists.
4. Web apps — Quickly build internal applications and publish them to specified user groups.
5. Shared skills — Skills are scoped by workspace and can be shared via grants; administrators can promote skills to organizational-level; supports importing skill packs from Git repositories.
6. Background work — Crons and watches perform scheduled tasks unattended.

Typical use cases include: unified retrieval across internal notes, emails, documents, databases and the web; triaging inboxes on a schedule and generating tags and reply drafts; running tests, opening PRs, and monitoring CI in existing code repositories; tracking projects in shared channels and following up automatically.

Architecture: Headless Core + Durable Sandbox¶

Every conversation in QM is processed through a central headless core. The core is responsible for APIs, identity, policies, and scheduling, and drives the Agent loop; it uses Postgres to persist session, memory, and queue state at the underlying layer.

The tool surface exposed by Agents is intentionally kept minimal. The key tool is execute: running commands in an isolated sandbox for the current scope. The sandbox is a “persistent computer” — installed CLIs and dependencies are retained, making it suitable for long-running engineering tasks.

In terms of technology stack (all from official documentation):
- Core: TypeScript on Node, with Fastify for the HTTP layer.
- Slack plugin: Bolt, launched and supervised by the core as an in-process plugin.
- Web UI: Built with Vite, rendered with Lit; the Admin panel and public portal are optional plugins mounted on top of the core HTTP API.

QM decouples from harnesses: Pi, OpenCode, Codex, and Claude Code can all drive the same core, and deployers do not need to bind to a single model or coding tool vendor. Each substrate (harness, session store, sandbox, memory) is abstracted via interfaces, and production implementations can be replaced in a single wiring file.

Custom organizational content (org config, custom tools/skills, sandbox images, infrastructure) is stored in a deployment directory, validated and deployed via the qm CLI, rather than hardcoded into the core.

Security Model: Strict / Auto / Dangerous¶

QM’s security philosophy aligns with local coding agents (OpenCode, Codex, Claude Code): Agents act on behalf of the employee they are serving, using their credentials, with full audit trails. The organization selects a security posture, and child scopes can only enforce stricter rules:

Regardless of the posture, predeclared command policies always take effect, including hard denial of operations such as recursive deletion and destructive SQL — these will not be allowed even in Dangerous mode.

For threat models, operational assumptions, and known limitations, see the repository’s SECURITY.md. Reports from outlets such as MarkTechPost also remind teams that large enterprises should prioritize reviewing the security posture before deployment; QM is more suitable for teams with 10–500 employees and at least one platform engineer.

Deployment: Self-Hosted on Your Cloud Account¶

QM is not a desktop application, but organizational software: it requires a cloud account, Postgres, and operations personnel who can manage infrastructure. You do not need to clone the source code for deployment — it is recommended to create an organization-specific deployment repository that depends on the @yc-software/qm package.

The official initialization command is as follows:

npm exec --yes --package=@yc-software/qm@latest -- \
  qm init . --org <slug> --target <fly-or-aws>
npm install

qm init generates a deployment skill and guides you through infrastructure setup, web login, connector credentials, optional Slack integration, official launch, and live verification. Each deployment runs in the operator’s own cloud account (supports Fly.io or AWS); initialization does not automatically create deployment CI.

Login uses the built-in broker by default, sending a one-time link via email; external IdPs can also be substituted. For more complete steps, see deployment.md and docs/getting-started.md.

If you want to maintain the core and custom code in the same repository and keep the custom code private, the official recommendation is to create a private fork using a plain clone (do not use the GitHub Fork button to avoid visibility and object network issues), place custom content in deploy/layers/<org>/, and keep the core byte-identical to the upstream branch for easy merging.

Why It Sparked Discussions About “Enterprise Agent Infrastructure”¶

QM quickly gained attention after its open source release, for three main reasons:
1. Verified Origin — YC uses it across non-engineering scenarios (accounting, legal, events), proving that Agent harnesses can start to assume company operational functions, not just write code.
2. MIT License + Self-Hostable — No waitlist, forkable and commercially usable, lowering the barrier for teams to run trials.
3. Harness-Agnostic — In 2026, where models and coding agents are evolving rapidly, the ability to “switch between Pi/Codex/Claude Code without changing infrastructure” is critical for enterprise purchasing decisions.

At the same time, we need to calmly view its limitations: YC states the project is early and buggy; deployment assumes a cloud-first workflow; the contribution process requires human-written text ADRs, not direct PRs for code changes. It is more like a runnable reference architecture + CLI scaffolding rather than an out-of-the-box SaaS.

Summary¶

QM (Quartermaster) is a corporate-grade multi-agent collaboration framework open-sourced by Y Combinator in late July 2026: it supports both Slack and web interfaces, provides isolated workspaces by user and room, uses Postgres for persistence, allows switching between Pi/OpenCode/Codex/Claude Code, and offers three security posture options: Strict, Auto, and Dangerous. If you are evaluating an Agent platform that supports multiple users, multiple channels, audit trails, and self-hosting, the official repository and qm init are the most direct starting points currently; before deploying to production, be sure to read SECURITY.md thoroughly and select the appropriate posture based on your team size and compliance requirements.

References:
- GitHub: https://github.com/yc-software/qm
- MarkTechPost Report: https://www.marktechpost.com/2026/08/03/y-combinator-open-sources-qm-multiplayer-ai-agent-harness/