Y Combinator Releases QM: An Open-Source Agent Harness With Isolated Sandboxes and Postgres Memory

AIDeveloper44 Team

Overview of the QM Agent Harness

Y Combinator has announced the open-sourcing of QM, an agent harness designed to scale AI assistant capabilities across startup environments. Short for "quartermaster"—a term referring to the officer responsible for coordination and supplies on a ship—QM is intended to give every employee and project access to a persistent, specialized agent. The release follows Y Combinator's internal experiments with various agent architectures to find a balance between flexibility and ease of administration.

According to the official documentation at github.com/yc-software/qm, the system is designed specifically for organizations rather than individuals. While many contemporary agents function as isolated personal assistants, QM is built as a "multiplayer" harness. This allows for isolated workspaces where employees work independently while still permitting collaborative interaction within shared Slack channels, group messages, and specific projects.

Development History and Internal Evolution

The development of QM was driven by iterative learnings within Y Combinator. The organization initially utilized a basic agent loop written in Ruby. This early version used tools to access internal data and provided immediate value, but it was constrained in scope. Over time, YC added support for crons and webhook triggers. However, the emergence of more advanced models like OpenClaw necessitated a shift in architectural direction.

YC subsequently experimented with provisioning over 50 Hermes agents for individual employees to serve as personal assistants. This experiment revealed that managing a fleet of that size was difficult to sustain. The goal for QM was to retain the flexibility of systems like Hermes while restoring the administrative simplicity found in their original Ruby-based loop. Crucially, YC sought a solution that they could host internally to maintain control over their data and infrastructure.

Technical Architecture and Capabilities

QM utilizes a headless core built with TypeScript on Node.js, using Fastify for its HTTP API. The persistence layer is handled by a Postgres database, which stores session history, memory, and task queues. The architecture is designed to be model-agnostic; it currently supports several drivers including Pi, OpenCode, Codex, and Claude Code. This design ensures that a deployment is not permanently tied to a single AI vendor.

Each user and room within the QM environment is assigned a scoped memory, a unique set of files, a keychain for credentials, and a durable sandbox. The sandbox acts as an isolated computer where the agent can execute commands, install tools, and perform tasks without affecting other parts of the organization. The user interface is accessible via a web app built with Vite and Lit, or through a Slack plugin that integrates directly into existing communication workflows.

Key Functional Features

• Scoped Identity: Configuration and identity are consistent across both the web interface and Slack.
• Web Application Deployment: Users can generate custom internal web apps and publish them to specific groups within the organization.
• Shared Skills: Skills are owned by specific scopes but can be shared via grants or promoted to the entire organization through admin-gated processes.
• Background Automation: The system supports crons and watches, allowing agents to perform work such as triaging inboxes or monitoring CI/CD pipelines while users are offline.

Security and Deployment Standards

Security in QM is managed through three distinct postures: Strict, Auto, and Dangerous. In the Strict posture, every tool call made by the harness requires human approval. The default Auto posture uses a classifier to screen data and tool results before they are presented to the model. The Dangerous posture removes content screening and pauses between tool calls, though it still adheres to a predefined command policy that prevents destructive actions like recursive deletes.

Deployment is handled via the qm CLI, which allows organizations to initialize a deployment directory that targets infrastructure providers like AWS or Fly.io. Notably, YC recommends a "private fork" strategy for organizations that wish to keep their customizations private. Rather than using the standard GitHub fork feature—which can inherit public visibility and share object networks—users are encouraged to create a plain clone. This method ensures that organizational secrets and custom tools remain isolated while allowing the core code to stay synchronized with the upstream repository.

Contribution Guidelines

The QM project maintains a specific policy regarding contributions. The maintainers only accept human-written text for documentation and architecture decision records (ADRs). Instead of submitting code directly, contributors are asked to describe desired changes informally in markdown files. If the proposal is aligned with the project goals, the maintainers handle the implementation. Vulnerability reporting is restricted to private channels as outlined in the project's security policy.

Enjoyed this?

Get more posts like this delivered to your inbox.

Subscribe