Y Combinator Open-Sources QM, Its Internal Multi-Agent Harness for Running a Company

Y Combinator has open-sourced the software that runs large parts of its own back office — an internal multi-agent system called QM that the accelerator says now touches its accounting, legal, events, and engineering work, and that was even used to help build itself.

The announcement landed on X on July 31, 2026, from YC's official account: "We've decided to open-source a multi-agent harness we use internally at YC. We call it 'QM' and it's meant to be easy to customize, like Hermes or OpenClaw, but useful for a whole company," the post read. "We use it across accounting, legal, events, and engineering (including building QM itself!). The whole project is under an MIT license. It is cloud-first and has Slack and web UI natively."

What YC actually shipped

QM — short for quartermaster, the shipboard role responsible for keeping supplies and order belowdecks — is a self-hostable, MIT-licensed platform published to GitHub under the yc-software organization, with a companion landing page at qm.ycombinator.com. The core is written in TypeScript on Node, uses Fastify for its HTTP layer, and stores session history and durable state in Postgres. Rather than shipping its own model or coding agent, QM is deliberately harness-agnostic: it can run Pi, OpenCode, Codex, or Claude Code as interchangeable backends driving the same underlying loop, so a company is not locked into a single model vendor. Installation is a single CLI command — "npm exec --package=@yc-software/qm@latest -- qm init" — that scaffolds an org-owned deployment repository in a customer's own cloud account.

The project's design center is scope. Every employee and every Slack room gets its own memory, file storage, credential "keychain" view, permissions, scheduled jobs (crons), web apps, and a durable sandbox, so that a finance employee's agent and an engineer's agent do not share context or access by default. According to reporting from AI/TLDR, which reviewed the GitHub repository and YC's project page, the same user identity carries across both the Slack integration and the web app, and shared "skills" are scope-owned but can be granted to others, with admin-gated promotion to the whole organization. QM ships three configurable security postures — Strict, which requires human approval for nearly every tool call; Auto, the default, which screens external data and tool outputs before they reach the model; and Dangerous, which removes that screening entirely. The system's own README, as quoted by Startup Fortune, frames the philosophy directly: "Most agents are designed like personal assistants," it states, "QM is designed for startups."

YC's own account of QM's origin, relayed by Startup Fortune, describes an iterative build: the accelerator first ran a basic agent loop written in Ruby with access to internal data, later added features like crons and webhook triggers, and at one point provisioned more than 50 individual Hermes agents as personal assistants for staff before concluding that managing a fleet at that scale was unwieldy. The open-source coding-agent project OpenClaw reportedly pushed the team toward the multi-tenant design that became QM.

Why It Matters

The QM release is a concrete data point in a broader shift: agentic AI is moving out of demos and pilot projects and into the daily operating mechanics of real organizations. YC is not merely claiming that agents can draft memos or answer support tickets — it is asserting that a fleet of scoped, permissioned agents can be woven into an organization's actual workflows: closing the books, drafting legal documents, coordinating events, and shipping code, with enough auditability and access control that a company would trust it with financial and legal data. That YC used QM to build QM itself is meant to function as a kind of proof of production use, not just a launch-day claim.

The decision to open-source the tooling rather than keep it proprietary is notable in its own right. Coverage from StartupHub.ai and AI/TLDR both frame QM as one of the first widely available harnesses to treat multi-tenant company deployment — as opposed to single-user personal assistants — as its primary use case, complete with admin controls and shared, promotable skills. Releasing that under a permissive MIT license, rather than gating it behind a waitlist or a hosted product, lowers the barrier for other startups to adopt similar internal infrastructure without building the orchestration, sandboxing, and Slack plumbing from scratch. It also puts YC's internal operational choices — including its explicit naming of a "Dangerous" mode with no review pauses — up for public scrutiny.

What to Watch

The near-term signal to watch is adoption: how many startups, especially ones in YC's own portfolio, actually deploy QM into production versus treating it as a curiosity. Also worth tracking is whether the four supported model backends — Pi, OpenCode, Codex, and Claude Code — remain in parity as vendors update their offerings, and how YC handles contributions, since the project reportedly accepts only human-written change proposals rather than direct code submissions, with the core team implementing anything it decides to merge. Finally, expect scrutiny of QM's security postures in practice, particularly whether startups running agents with real credentials in "Auto" or "Dangerous" mode encounter the kind of incidents that have already dogged other agent deployments this year.