YC open-sources QM, the multi-agent harness it runs on accounting, legal, and code

Y Combinator just open-sourced the literal harness it uses to run agents across its own operations. The project is called QM — short for quartermaster — and it ships under an MIT license. This isn’t a polished product launch. The YC team is upfront: the release is early, it has bugs, and it’s an experiment. But it’s also real infrastructure that already touches accounting, legal, events, and engineering inside one of the most influential startup institutions in the world. That makes it worth a serious look.

The core idea is simple but sharply argued. Most agent frameworks treat AI as a personal assistant. YC’s team points out that stretching one assistant across an entire company gets messy fast. QM instead gives every employee and every Slack channel its own isolated workspace — scoped memory, its own files, a separate keychain, independent permissions, crons, and a durable sandbox. Nobody else’s agent can mess with your stuff. Collaboration happens when people invite the agent into channels or group messages, not by sharing a global brain.

Under the hood, a headless TypeScript core handles identity, policy, scheduling, and the agent loop. The tool surface is deliberately small. One of those tools — execute — runs commands inside the scope’s sandbox, where installed tools stay installed. What’s clever is the harness-agnostic design. Pi, OpenCode, Codex, and Claude Code can all drive the same core, so a deployment isn’t chained to any single model provider. For teams who’ve watched the LLM pricing wars with exhaustion, that flexibility matters. The security posture is similarly pragmatic: three levels from strict to dangerous, with destructive-command denials hard-coded across all of them. A classifier screens external data before it reaches the model in the default auto mode.

Deploying QM is not a one-click affair. It assumes someone comfortable with a cloud account, Postgres, and infrastructure. The sweet spot is a startup or mid-sized company with at least one platform engineer. An initialization command materializes a deployment skill that walks you through infrastructure, web sign-in, connectors, and optional Slack access. Sign-in defaults to a built-in broker that emails a one-time link. For a framework the YC team itself calls buggy, the deployment story is surprisingly thorough. The real question is whether the isolation model actually prevents the coordination problems that plague shared agent setups, or just replaces them with fragmentation. That’s something the docs don’t answer yet — and probably won’t until more teams outside YC start kicking the tires.