Y Combinator Open-Sources QM: An MIT-Licensed Multiplayer Agent Harness That Runs In Slack And The Web

Y Combinator just did something a little unusual for a startup accelerator: it open-sourced its own internal tooling. QM, short for quartermaster, is the multi-agent harness YC has been running across accounting, legal, events, and even the engineering work that builds QM itself. The whole thing ships under an MIT license, and YC is upfront that it's early and buggy — this isn't a polished product launch, it's a working system being handed over mid-build.

What makes QM different from the typical single-user AI assistant is scope. Most agent tools are built as one assistant per person. YC's team found that stretching a single assistant across an entire company gets messy fast, so QM instead gives every employee their own isolated workspace — separate memory, files, permissions, crons, and a durable sandbox that nobody else can touch. People can also work with the agent collectively in Slack channels, group chats, or shared projects, and each of those rooms gets its own scoped setup too. The same identity carries across Slack and the web app, so switching between them doesn't mean starting over.

Under the hood, a central headless core handles identity, policy, scheduling, and the agent loop, backed by Postgres for durable state. Notably, QM doesn't lock you into one AI vendor — Pi, OpenCode, Codex, and Claude Code can all drive the same core, so a company isn't stuck if it wants to swap models later. The tool surface itself stays small and fixed, with an execute function that runs commands inside each scope's own sandbox.

Security gets real attention here, following the same pattern as local coding agents: the agent acts with the actual credentials and permissions of the person it's working for, and everything gets logged. Orgs choose one of three postures — Strict pauses every tool call for human approval, Auto (the default) runs external data through a screening classifier before it reaches the model, and Dangerous drops that screening layer entirely. Even in Dangerous mode, though, hard denials block destructive actions like recursive deletes or destructive SQL. As for who should actually deploy this: YC pegs the sweet spot at companies with 10 to 500 people that have at least one platform engineer on hand, since setup assumes a cloud account, Postgres, and someone who's comfortable with infrastructure. Larger enterprises can run it too, but YC recommends a security review first.