Y Combinator just open-sourced the agent stack it runs the firm on — not another personal chatbot, a company harness.
On July 31, 2026, @ycombinator announced QM: the multi-agent harness YC uses across accounting, legal, events, and engineering — including building QM itself. License: MIT. Shape: cloud-first, with Slack and a web UI native. Repo: github.com/yc-software/qm (~1.9k stars within hours of the announcement; homepage qm.ycombinator.com).
YC’s framing is the story: easy to customize like Hermes or OpenClaw, but built for a whole company. That lands squarely in the agent harness layer — orchestration, scopes, memory, sandboxes, approvals — not a new foundation model.
TL;DR
| Question | Answer |
|---|---|
| What shipped? | Open-source QM — YC’s internal multiplayer agent harness |
| When? | Announced Jul 31, 2026 (X thread) |
| License | MIT (yc-software/qm) |
| Surfaces | Slack + web (same identity); optional admin / portal plugins |
| Who it’s for | Startups / orgs — personal scopes and shared rooms |
| Inner loops | Pi, OpenCode, Codex, Claude Code drive one core |
| Deploy | qm init → your Fly/AWS account + deployment directory |
| YC’s caveat | Early, buggy experiment — used in production at YC, not a polished SaaS |
What people are asking
“Is this just Claude Code with Slack?”
No. Claude Code (and OpenCode, Codex, Pi) can drive QM’s agent loop. QM adds the company OS around them: identity, Postgres state, per-person and per-room scopes, keychains, crons, skills grants, admin policy, and Slack/web plugins.
“Why open-source the operating system of YC?”
YC’s pattern: ship internal tools that help the ecosystem of startups (and dogfood under public scrutiny). QM becomes a reference architecture for “multiplayer AI at work” — a theme that also shows up in YC’s Fall 2026 RFSs and in human+agent rooms like Block Buzz.
“Can I run it like a personal OpenClaw?”
You can self-host, but the product thesis is org deployment: admin security postures, shared projects, connectors to a company brain. If you only want a solo Telegram/CLI assistant, Hermes/OpenClaw remain simpler. If you want finance + legal + eng on one policy plane, QM is the closer fit.
What YC said shipped
From the announcement thread and README:
| Feature (YC / README) | What it means in practice |
|---|---|
| Triggers | Crons + webhooks for unattended work |
| Memory + shared files | Scoped persistence per person / room |
| Company-brain connectors | Search notes, email, docs, DBs + web together |
| Agent browser | Browse as a tool inside the harness |
| Shareable web app artifacts | Spin up internal apps; publish to the right people |
| Multi-player projects | Channels / group threads / shared projects |
| Shared skills | Scope-owned skills, grant-based share, admin promotion, git skill packs |
YC’s honesty line: early, has bugs, experiment — while still claiming real internal use across non-eng departments. That breadth matters more than star count: most open harnesses are coding-first; QM claims ops + legal + events as first-class.
Architecture (from the README)
Postgres (sessions · memory · queue)
↕
Headless core: API · identity · policy · scheduler
↕
Agent loop (Pi / OpenCode / Claude Code / Codex)
↕
Per-scope sandbox (files · tools · logged-in services)
- Core: TypeScript on Node, Fastify HTTP.
- Slack: Bolt plugin supervised by core.
- Web UI: Vite + Lit; admin and public portal are optional plugins.
- Tools: Small fixed surface;
executeruns in the scope’s durable sandbox (installed tools stay installed). - Customization: Org-specific config lives in a deployment directory the
qmCLI validates — not forks of core for every tweak.
That last point is the enterprise lesson: keep core byte-identical to upstream; put secrets, sandbox image, and custom skills in deploy/layers/. Private-fork docs even warn against GitHub’s Fork button (visibility / object-network leakage) and recommend a plain clone + upstream remote.
Security postures (read before you enable Auto)
QM mirrors local coding-agent threat models: the agent acts as the person, with their credentials, under audit.
| Posture | Behavior |
|---|---|
| Strict | Every harness tool call pauses for human approval (except no-effect turn enders) |
| Auto (default) | Classifier screens provenance-labelled external data / tool results; can point at your screening proxy |
| Dangerous | No content screening, no pauses between tool calls |
A predeclared command policy (hard denials for recursive deletes, destructive SQL, etc.) still applies even in Dangerous. Operators should start from SECURITY.md — threat model, assumptions, known limits.
Deploy path (actionable)
Create an org-owned deployment repo that depends on @yc-software/qm:
npm exec --yes --package=@yc-software/qm@latest -- \
qm init . --org <slug> --target <fly-or-aws>
npm install
Init materializes a deployment skill for an agent and walks infrastructure, web sign-in, connector credentials, optional Slack, deploy, and live verification — no source checkout of qm required for the default path. Each deploy runs in your cloud account; the public repo does not ship a YC-hosted production CI for your org.
Going deeper on the repo:
QM vs OpenClaw vs Hermes vs coding harnesses
| Dimension | QM | OpenClaw | Hermes | Claude Code / OpenCode / jcode |
|---|---|---|---|---|
| Primary user | Whole company | Personal / small team | Personal / remote VPS | Developer in a repo |
| Chat surface | Slack + web | Mobile / claws / chat | Telegram / CLI | TUI / IDE / desktop |
| Org admin + postures | First-class | Weak / DIY | DIY | Per-developer |
| Multiplayer projects | Native | Emerging | Limited | Swarm / multi-session (e.g. jcode) |
| Vendor lock | Loop pluggable | Stack-specific | Stack-specific | Tied to that harness |
| License | MIT | Varies by project | Varies | Usually MIT/Apache for open ones |
YC’s comparison to Hermes/OpenClaw is about customizability culture, not feature parity. For a taxonomy of harnesses, start with our complete agent harness guide and top open/closed harnesses 2026.
What you can actually run (README use cases)
Practical checklist for a pilot team:
□ Inbox triage on a cron (labels + draft replies in your voice)
□ Shared channel that tracks a project and posts follow-ups
□ Internal tool that queries company docs + a DB with scoped memory
□ Repo workflow: tests, PRs, CI watch, log checks via sandbox execute
□ Publish a small internal web app artifact to a grant list
□ Import a skill pack from git; promote one skill org-wide via admin
If none of those need shared identity + Slack, you may be overbuying — stay on a personal agent. If three or more do, QM’s scope model is the point.
Unusual contribution model
QM takes contributions as human-written text, not code PRs: describe the change informally in adrs/ as .txt / .md; if aligned, YC implements. Vulns go private per SECURITY.md, not public issues. That is unusual for MIT GitHub culture — plan on issues + ADRs, not drive-by TypeScript PRs.
Honest limitations
- Early / buggy by YC’s own admission — expect sharp edges on Slack sync, connectors, and multiplayer race cases.
- Cloud-first — not a laptop-offline OpenClaw replacement.
- Connector quality decides whether “company brain” is real or vapor; each org wires its own.
- Cost = your Fly/AWS + model APIs + any screening proxy — MIT does not make tokens free (token economics).
- Recursive claim (“engineering builds QM with QM”) is powerful marketing; treat it as dogfood, not a benchmark.
- Star velocity on day one is not production maturity (27 open issues at snapshot).
Pilot plan (first two weeks)
| Week | Goal | Success signal |
|---|---|---|
| 0 | Deploy on Fly/AWS with Strict posture; one admin + two IC users | Sign-in works; Slack optional deferred |
| 1 | One shared project channel + one personal inbox cron | Agent posts useful updates without credential leaks |
| 2 | Import one skill pack; publish one internal web artifact | Grants work; non-admins cannot escalate posture |
Document every connector secret in your keychain process before flipping Auto. Pair this with how AI agents work end to end if your ops team is new to tool loops, and agent skills before importing untrusted skill packs from git.
Closing
QM is YC putting its company-wide agent harness on GitHub under MIT — Slack + web, personal and shared scopes, crons, skills, sandboxes, and pluggable coding loops. The July 31 announcement positions it next to Hermes/OpenClaw for hackability, but the README positions it next to org infrastructure.
For builders on explainx.ai: study the deployment-directory split and security postures even if you never run QM — those patterns will show up in every serious multiplayer agent product in 2026–27.
Follow @explainx_ai when the first non-YC production write-ups land.
Related on explainx.ai
- Satya Nadella ROIC App — Copilot skills + Fabric governance
- What is an agent harness?
- Top 10 open & closed agent harnesses (2026)
- Hermes Agent vs OpenClaw
- What is OpenClaw?
- OpenClaw Foundation
- Pi minimal agent harness
- jcode — swarm & memory harness
- Block Buzz — humans + agents workspace
- YC Requests for Startups Fall 2026
- How AI agents work end to end
- What are agent skills?
- Agent harness engineering — seven planes
Sources
- Y Combinator on X — QM announcement (Jul 31, 2026)
- yc-software/qm · qm.ycombinator.com
- README: architecture, security postures,
qm init, contributing ADRs
Repo stats (~1.9k stars, ~177 forks, MIT) and feature claims reflect public GitHub + YC posts as of August 1, 2026. Verify SECURITY.md, deployment docs, and current releases before production use. YC’s “early and buggy” disclaimer still applies.