YC Open-Sources QM: The Multiplayer Agent Harness That Runs Y Combinator

TL;DR — Y Combinator open-sourced QM, the internal multiplayer agent harness it uses across accounting, legal, events, and engineering. MIT license, 7.5K GitHub stars in three days. The architecture is scoped: each employee and Slack room gets its own memory, files, credentials, permissions, and sandbox. Four coding agents (Pi, OpenCode, Codex, Claude Code) can drive it interchangeably. Security is the real story: twice as much code governs access control as drives the model, and the threat model names its own gaps.

What YC Just Put on GitHub

On July 31, 2026, Y Combinator published QM — short for Quartermaster — under an MIT license. Not a demo. Not a waitlist. The actual harness YC built after running 50+ individual Hermes agents internally and hitting the ceiling of what personal assistants can do when you give them to a whole company.

The numbers tell the reception: 7,500 stars and 788 forks in three days, 2.3 million views on the announcement thread. But what matters isn’t the hype — it’s what YC chose to build differently from every other agent platform.

The core runs TypeScript on Node with Fastify for HTTP and Postgres for state. Slack is an in-process plugin via Bolt. The web UI builds with Vite and renders with Lit. The repo counts 342 TypeScript files across 50 modules, and here is the ratio that tells you what QM actually is: 13 files implement the harness — the model-calling loop. 26 implement access control, identity, auth, audit, policy, credentials, and security. Twice as much code governs who may see what as drives the agent.

(Source: AI Builder Club — YC QM Agent Harness: A Source-Code Read)

The Design That Makes QM a Company System, Not a Personal Assistant

The unit is the scope, not the user. Every person gets one scope. Every Slack room gets one scope. Each scope owns its full stack independently: memory, filesystem, credential keychain, cron schedule, web apps, and a durable sandbox. A shared channel’s agent has access to the same accumulated context no matter which colleague speaks to it.

Model choice is org policy, not a user preference. An admin sets which harnesses and models are approved. Individuals inherit the org default and can override within the allowlist — but can never select a prohibited runtime. resolveRuntimeChoice in the harness router validates every selection back to the approved list.

Credentials are scoped, not ambient. Finance’s email token doesn’t leak into Engineering’s sandbox. A scope sees only its own keychain entries.

Audit is built in, not bolted on. Every egress decision goes to an audit sink. Every turn is logged. Agent actions are attributable to a person and a scope.

(Source: Y Combinator — QM Announcement; Wavect — QM AI Agent Review)

This is a fundamentally different answer to the question “how do you give AI agents to a company?” than what came before. Claude Code, OpenCode, and Codex are coding agents for one developer in one repo. Hermes and OpenClaw are personal assistants that scale to power users. QM sits one layer up — it’s the operating system that governs a fleet of agents across departments, each with its own boundary.

Multiplayer Means Redacting the Transcript, Not Just the Room

The most revealing file in the repo is src/harness/tape-fold.ts. In a shared room, multiple people with different permissions see the same agent conversation. So filterTapeForAudience filters the session tape per viewer, checking every record against every viewer’s scope entitlement.

When a viewer lacks permission for a message, the tool result isn’t dropped — it’s substituted with a placeholder. Dropping it would corrupt the transcript structure for a reader who can still see the tool call that preceded it. Substitution keeps the conversation structurally valid while enforcing access boundaries.

This is the kind of production scar that only comes from running agents at scale. Anyone can put an agent in a Slack channel. Getting the transcript to say different things to different readers, without breaking the conversation model, is the engineering.

(Source: AI Builder Club — Source-Code Read)

The Egress Proxy Is the Real Sandbox

QM ships a standalone authorizing proxy (src/egress-authz-main.ts) that every sandboxed command must pass through. Its defenses are specific and address known attack vectors:

Signed capability tokens per request, verified with JWS compact serialization, not ambient network trust
Cloud metadata endpoints blocked by name: metadata.google.internal, metadata.goog, and the IPv4 link-local 169.254.0.0/16
Hostnames resolved and re-checked — the IP is verified after DNS resolution, closing DNS rebinding
IPv6 link-local (fe80::/10) and EC2-specific ranges (fd00:ec2::254) blocked

That 169.254.169.254 block is the tell. It’s the AWS metadata endpoint — the thing that turns an agent that can curl a URL into an agent holding your cloud credentials. It’s one of the first things a security reviewer asks about and one of the last things a hobby project implements.

(Source: QM GitHub Repository — SECURITY.md)

Memory Is a Markdown Notebook, Not a Vector Store

There’s no embedding index anywhere in QM’s memory path. Memory lives as a markdown notebook of atomic bullet facts, each stamped with a capture date, stored in Postgres. Three strategies ship, selectable per deployment:

Strategy	Behavior
`per-turn` (default)	Extracts facts as turns complete
`scratch-promote`	Buffers to a scratch area, promotes what survives
`agent-only`	The agent writes its own memory, no automatic extraction

Consolidation is where it gets interesting. After 10 new bullets accumulate below a marker, a model pass runs over the numbered notebook and returns actions, not prose: UPDATE, DELETE, ADD:, or exactly NONE. The prompt instructs the model to prefer UPDATE over DELETE-plus-ADD when a fact evolved, keep every fact atomic, and delete what’s stale or contradicted.

The action-list format means memory edits are reviewable and diffable. You can see what your agent decided to forget. That’s a better audit trail than a rewritten memory file — and it’s the same consolidation pattern circulating from AI labs, shipped in code you can read.

(Source: AI Builder Club — Source-Code Read; QM Repository)

Where QM Fits in the Agent Harness Landscape

QM doesn’t replace personal agents — it adds a company-wide governance layer above them. The comparison table is instructive:

Dimension	QM	Hermes / OpenClaw	Claude Code / Codex / OpenCode
Primary user	Whole company	Personal / power user	Developer in a repo
Scopes	Person + room, isolated	Single user	Single session
Org admin + policy	First-class	DIY or absent	Per-developer
Multiplayer	Native (tape filtering, substitution)	Emerging / limited	Swarm / multi-session
Vendor lock	Harness-pluggable (4 options)	Stack-specific	Tied to one harness
License	MIT	Varies	Varies

(Source: explainx.ai — YC QM Open-Source Multi-Agent Harness)

For a startup on Slack that wants one agent system across functions — not five separate bots with five different auth models — QM’s scope model is the differentiator. If you just want a personal AI assistant, Hermes or OpenClaw remain simpler. The decision turns on whether your problem is “my agent” or “our agents.”

The Honest SECURITY.md

Most open-source agent launches bury their security posture in marketing language. QM’s SECURITY.md is unusually direct about its limits:

Org admins can read scoped content without user approval. “An admin is a privileged content reader, not only a policy administrator.” Defensible for a startup, disqualifying in regulated environments.
Not a hardened multi-tenant boundary. Assumes one organization of authenticated internal users. Published web apps are the deliberate exception with capability-link authorization.
Does not protect against a compromised operator.
Version 0.1.0. Explicitly “early, has bugs, experiment.”

(Source: QM SECURITY.md)

A threat model that names its gaps is a stronger signal about engineering culture than any benchmark. It’s the document to hand your security reviewer before you deploy.

Should You Deploy QM?

Reasonable yes: You’re a technical startup on Slack, you want private scopes plus shared rooms, you can operate Postgres and Fly.io or AWS, and you accept beta software where admins can read agent conversations.

Reasonable no: You need multi-tenant or external-user boundaries, you’re in a regulated environment, or you want a managed product with an SLA.

The middle path: Read the five architectural patterns above. Steal the two that fix a hole you already have (the egress proxy, the scope model, the reviewable memory consolidation). Watch the repo. YC is accepting contributions via ADRs — human-written text, not code PRs — which is an unusual model that may accelerate or stall depending on maintainer bandwidth.

QM’s real value isn’t necessarily as a deployment target. It’s as the first reference architecture for what a company-wide agent operating system looks like when the people who built it already ran 50+ agents internally and hit the walls themselves.

FAQ

Q: Is QM just Claude Code with Slack?
No. Claude Code, OpenCode, Codex, and Pi can all drive QM’s agent loop, but QM adds the company OS around them: identity, scoped persistence, admin policy, audit, web apps, crons, and the egress proxy. It’s a governance layer, not a model wrapper.

Q: How does QM compare to Hermes or OpenClaw?
Hermes and OpenClaw are personal agent platforms — excellent for individual power users. QM targets the company-wide problem: multiple people with separate scopes sharing rooms, with centralized policy. If you’re one person, stick with Hermes. If you’re a team of 20+ across four departments, QM’s scope model is what you need.

Q: Is it safe to give QM access to company data?
QM isolates data by scope and ships a real egress proxy. But SECURITY.md is explicit: admins can read content, it’s not multi-tenant, and it doesn’t protect against compromised operators. Start with the Strict security posture (every tool call requires human approval) and read SECURITY.md before deploying.

Q: What does it cost to run?
QM itself is free (MIT). Costs come from cloud infrastructure (Fly.io or AWS, Postgres, compute), model API usage (tokens per employee/workflow), and platform engineering time (deployment, upgrades, incident response, credential management). The Wavect review estimates a realistic pilot requires dedicated platform engineering capacity.

Q: Can QM use models other than the four listed harnesses?
Currently, the supported harnesses are Pi, OpenCode, Codex, and Claude Code — each with its own adapter behind a shared Harness interface. Adding a new one means writing a new adapter. The architecture is designed for it, but it’s not a config-file change yet.