Y Combinator Open-Sources QM: MIT-Licensed Multiplayer Agent Harness for Slack and Web

Y Combinator's team has open-sourced QM (quartermaster), the multiplayer agent harness it uses internally, under an MIT license. QM is designed for work and operates in Slack and on the web, and YC runs it across accounting, legal, events, and engineering, even using it to build QM itself. The project is described as early and buggy, but deployable today, assuming a cloud account, Postgres, and infrastructure expertise, with the best fit being startups or mid-sized companies of 10 to 500 people. QM gives each employee an isolated workspace with scoped memory, files, keychain view, permissions, crons, and durable sandbox, and supports collaboration in channels and group messages. The architecture features a central headless core handling API, identity, policy, and scheduling, with a Postgres layer for durable state. QM is harness-agnostic, supporting Pi, OpenCode, Codex, and Claude Code to drive the same core, avoiding vendor lock-in. Security follows the pattern of local coding agents, with three org security postures (Strict, Auto, and Dangerous) that gate tool calls, and destructive-command denials apply in all postures. Deployments run in the operator's own cloud account, and initialization does not create deployment CI. Key takeaways include isolated memory and sandbox per person and room, support for multiple models, and three security postures.