---
title: "YC QM Agent Review: Quartermaster for Work"
canonical: https://wavect.io/blog/qm-ai-agent-harness-review/
language: en
description: "YC QM agent review: Quartermaster architecture, Slack collaboration, Fly.io or AWS deployment, security postures and a measurable company pilot."
image: "https://wavect.io/img/blog/headers/header_qm-ai-agent-harness-review.png"
---

[**Back**](/blog/overview/)

[![Kevin Riedl](/img/team/kevin.webp)](/team/kevin-riedl/)

[Kevin Riedl](/team/kevin-riedl/) https://linkedin.com/in/wsdt

12 min read · 2 Aug 2026 Last reviewed August 11, 2026

[**Next**](/blog/multi-model-ai-coding-agent-stack-2026/)

# YC QM Agent Review: Is Quartermaster Ready for Work?

TL;DR

QM, short for Quartermaster, is Y Combinator's primarily MIT-licensed multiplayer agent harness for company work. It gives each employee, room and project an isolated scope for memory, files, credentials, permissions, schedules, apps and sandboxed execution, while a central core handles identity, policy and audit. The current project supports Slack and web surfaces, Pi, OpenCode, Codex and Claude Code harnesses, shared skills, background work, and organization-owned deployments on Fly.io or AWS. QM is promising for a technical startup that can operate the infrastructure and start with a narrow, reversible workflow. It is not turnkey SaaS or a hardened public multi-tenant boundary. Treat it as a pilot platform and measure accepted task completion, review effort, cost and cross-scope incidents before production.

**QM, also called Quartermaster or the YC QM agent, is an open-source harness for giving employees and shared rooms isolated AI workspaces under one company control plane.** It can connect Pi, OpenCode, Codex, or Claude Code to Slack and the web, with separate memory, files, credentials, permissions, schedules, and sandboxes for each scope.

Our verdict after reviewing the current code, deployment documentation, release metadata, and threat model on 11 August 2026: **QM is worth a bounded 30-day pilot for a technical startup with a narrow internal workflow and platform-engineering capacity.** It is not turnkey SaaS, a hardened public multi-tenant boundary, or a safe default for unattended high-impact actions. We did not deploy or benchmark QM for this review, so performance and operating-cost claims would be speculation.

This article targets the product-specific question, not the broader orchestration keyword. For the human supervision constraint, read our analysis of the [focus bottleneck when teams run multiple AI agents](/blog/focus-bottleneck-orchestrating-ai-agents/). For the authorization layer, see why [MCP is not a data security boundary](/blog/mcp-security-boundary-data-level-access-control/).

## What is QM by Y Combinator?

**QM, short for Quartermaster, is an MIT-licensed multiplayer agent harness released by Y Combinator in July 2026.** YC says it built QM after experimenting with an internal agent loop and then operating more than 50 individual Hermes agents. The goal is to combine a flexible personal agent with administration for a whole organization. The [official YC announcement](https://qm.ycombinator.com/) describes employees and projects receiving agents as needed.

"Multiplayer" does not mean that several models debate in one chat. It means multiple people can have private agent scopes and collaborate with shared scopes in Slack channels, group messages or projects. According to the [QM repository](https://github.com/yc-software/qm), each person and room gets its own memory, workspace, credential view, permissions, schedules, apps and durable sandbox.

| QM layer | What it owns | Buyer implication |
| --- | --- | --- |
| Core | API, identity, policy, scheduler and agent loop | One control plane must be operated and secured |
| Scope | Person, room or project context and grants | Collaboration does not require one global memory |
| Sandbox | Files, tools, commands and logged-in services | Useful work is possible, but credentials and execution create risk |
| Harness adapter | Pi, OpenCode, Codex or Claude Code | The organization can change harnesses without replacing the core |
| Surface plugin | Slack, web UI, admin panel or public portal | Channels are optional interfaces, not the source of truth |

## What problem does QM solve that a personal agent does not?

A personal agent assumes one user, one set of credentials and one context owner. A company has conflicting requirements: Alice's email token must not appear in Bob's sandbox, a channel needs shared memory, admins need policy control, scheduled work must survive a browser tab, and every side effect needs attribution.

QM makes those concerns explicit. A central Postgres layer stores sessions, memory and queued work. A headless TypeScript core runs policy and the agent loop. Each scope gets an execution environment. Slack and the web app sit on top as optional surfaces. This is a stronger starting architecture than placing one powerful bot token behind a shared channel and hoping the prompt keeps users separated.

The important distinction is **multi-user isolation**, not multi-agent spectacle. That exact intent is underserved in current search results, which often mix team agents, agent swarms, chatbots and workflow builders into one category.

## Who should evaluate QM, and who should wait?

| Pilot QM now when | Wait or choose another route when |
| --- | --- |
| You are a technical startup with an internal Slack-first workflow | You need a managed product with an SLA and vendor support |
| You want infrastructure and data in your own Fly.io or AWS account | You require on-premises, air-gapped or another cloud target today |
| You need private employee scopes plus shared project scopes | Your use case is a public, multi-tenant customer agent |
| You can assign an operator for upgrades, incidents and access reviews | Nobody owns the control plane after the demo |
| You can begin with read-only or draft-producing work | The first workflow must autonomously move money or modify production |

## How mature is QM in August 2026?

The signal is mixed. On 11 August, the repository showed about 13,000 stars and 1,500 forks, up sharply from roughly 5,400 stars and 550 forks observed four days earlier. It supports several harnesses, includes substantial automated testing and documents deployment for Fly.io and AWS. The root workspace still declares version `0.1.0`; the deployable CLI manifest on `main` declares `0.1.5`, while the newest visible GitHub tag was `v0.1.4`. The project security policy explicitly calls QM early, experimental software. Rapid popularity and release activity show developer attention, not production reliability.

The public deployment path is unusually agent-native. The `qm init` command creates an organization-owned deployment repository and a deployment skill, then guides an operator through identity, model credentials, optional Slack setup and live checks. The [official getting-started guide](https://raw.githubusercontent.com/yc-software/qm/main/docs/getting-started.md) says the organization chooses Fly.io or AWS, and that initialization does not create production CI.

That is a smart bootstrap for technical teams. It also transfers responsibility to the buyer. You own cloud billing, networking, identity, database operations, secrets, upgrades, incident response, backups and the model-provider relationship.

## What are QM's most important security limits?

QM deserves credit for publishing a concrete threat model instead of hiding behind "enterprise-grade" language. The same document is the strongest reason not to treat a successful demo as production approval. The [official security policy](https://raw.githubusercontent.com/yc-software/qm/main/SECURITY.md) says QM is not a hardened public or multi-tenant boundary and lists current limitations.

| Documented limitation | Practical consequence | Pilot control |
| --- | --- | --- |
| Command policy can be bypassed | Obfuscation or script indirection can evade text classification | Use an enforced sandbox rather than treating command policy as containment |
| Browser actions sit outside some core gates | Browser-runner actions do not re-enter command policy or per-tool approval, and browser traffic bypasses QM's egress proxy | Limit browser tasks, provider spend and reachable destinations separately |
| Credentials are plaintext while used, and their stated purpose is not enforced | A compromised sandbox process may spend or exfiltrate a valid credential beyond its intended purpose | Issue narrow, short-lived credentials and cap effects in the connected service |
| Screening and audience filtering are incomplete | Some outputs, payloads and mixed-permission context can reach the model without complete coverage | Start with approved sources and deterministic read and write gates |
| Egress enforcement depends on the backend | QM does not yet reject every backend that is too coarse for a requested policy | Prove network enforcement on the selected sandbox and deployment runtime |
| Admins can read sensitive content and durable data may persist | Audited admin reads need no extra consent, while captures and artifacts can outlive expectations | Restrict admins and define tested retention and deletion procedures |
| Published-app links and portal sessions carry residual risk | Copied bearer links remain usable, and logout cannot revoke an already copied session token before expiry | Treat links as credentials, isolate public apps and test revocation expectations |
| Some provider and governance controls remain incomplete | Certain model paths bypass the intended gateway; org kill switch, uniform governance rollback and file-write secret scanning are unfinished | Keep an external stop path and verify provider routing, governance recovery and secret controls |

A robust deployment therefore needs controls at several layers: identity, scope grants, sandboxing, network egress, data-level authorization, credential lifetime, action approval and audit. Our [RAG and AI architecture work](/services/ai-enablement/) treats those as system requirements, not prompt instructions.

## What does a QM deployment really cost?

QM is open source, but the license fee is the least important line in total cost of ownership. A realistic budget includes:

- **Platform time:** deployment, identity, Slack manifests, observability, backups, upgrades and incident handling.
- **Cloud resources:** core services, Postgres, object storage, queues, sandbox compute, networking and logs.
- **Model and browser usage:** token spend, web automation and retries, with budgets per person or workflow.
- **Security work:** threat modelling, least-privilege credentials, egress policy, retention, review and testing.
- **Workflow engineering:** connectors, skills, evals, approval paths and failure recovery.

The [deployment workflow](https://raw.githubusercontent.com/yc-software/qm/main/cli/templates/deployment/deployment.md) requires Node 24+, npm, Git, Docker with Buildx and OpenSSL. The current bootstrap resolves `@yc-software/qm@latest`, then `qm init` pins that exact CLI version in the deployment repository. Initialization also fixes the Fly.io or AWS target and a model provider such as Anthropic, OpenAI or OpenRouter. Sign-in can use Slack, the built-in emailed-link broker or external OIDC. Operators must confirm billable resources and provider identity, then prove the web response and any requested Slack path with live checks. That is responsible automation, but it is not one-click SaaS.

## QM vs a personal assistant, workflow platform or custom build

| Option | Best for | Main trade-off |
| --- | --- | --- |
| Personal agent | One power user automating their own work | Weak fit for shared scopes and company administration |
| Managed workflow platform | Predictable integrations and fast operational ownership | Less control over harness, data plane and custom execution |
| QM | Technical startups needing private and shared agent workspaces | Early software plus meaningful operator responsibility |
| Custom company-agent platform | Unique policy, compliance or product requirements | Highest build and maintenance cost |

Do not choose on feature count. Choose the boundary you are prepared to own. The relevant commercial decision is often [custom software versus an off-the-shelf platform](/software-development-guide/custom-software-vs-off-the-shelf/), with QM occupying a useful middle ground: open core, opinionated architecture and owner-operated deployment.

## How should a company run a 30-day QM pilot?

1. **Pick one workflow with a named owner.** Good examples are internal research, incident context collection or draft preparation. Avoid payments, production writes and external customer access.
2. **Define the scope boundary.** List people, channels, data sources, credentials, allowed commands and prohibited effects.
3. **Establish a human baseline.** Measure current cycle time, completion rate and review effort on 20 to 50 comparable tasks.
4. **Deploy a separate pilot environment.** Use synthetic or low-sensitivity data first. Do not add QM to a working production account as an experiment.
5. **Test isolation and failure paths.** Attempt cross-scope reads, indirect prompt injection, credential misuse, duplicate jobs, cancellation and emergency shutdown.
6. **Decide with evidence.** Scale only if useful-task completion improves without unacceptable review time, access violations or unbounded cost.

Track five numbers: useful completion rate, median human review minutes, cost per accepted task, blocked unsafe-action rate and cross-scope access incidents. A pilot that produces impressive transcripts but no reliable accepted output is not working. Our [AI agent pilot scorecard](/blog/ai-agent-pilot-30-60-90-days/) gives a broader rollout sequence.

## Should your company adopt QM?

**Adopt QM as a pilot platform, not as a trust shortcut.** Its core idea is strong: company agents need explicit scopes, durable execution, shared collaboration, pluggable harnesses and centralized policy. Its public threat model is candid. Its deployment model preserves ownership.

The open questions are operational, not cosmetic. Can your team enforce isolation outside the model, manage credentials, review admin access, govern durable data, fund the control plane and recover when automation fails? If yes, QM may save months of foundation work. If no, a managed platform or a narrower custom workflow will usually reach value faster.

## Frequently Asked Questions

### What does QM stand for?

QM is short for Quartermaster. Y Combinator uses the name for its open-source multiplayer agent harness for company work, not quality management software.

### Is QM an AI model?

No. QM is an agent harness and control plane. It can run several model and harness combinations, including Pi, OpenCode, Codex and Claude Code, while keeping organizational state and policy in a shared core.

### Is QM open source and self-hosted?

Yes. The repository is primarily MIT-licensed, and deployments run in the operator's own cloud account. The documented production targets are Fly.io and AWS; local Docker is positioned as a test path.

### Is QM production-ready?

Not by default. The project calls itself early, experimental software and documents material security limitations. A production decision needs deployment-specific security, operational and compliance review.

### Does QM support Slack?

Yes. Slack is an optional plugin and can provide agent interaction or sign-in. The web UI, admin panel and portal are separate optional surfaces over the same core.

### Who should evaluate QM?

The strongest fit is a technical startup that wants private employee scopes plus shared project or Slack scopes, accepts owner-operated infrastructure and can start with a narrow, reversible internal workflow.

## Primary sources

1. [Y Combinator: QM announcement](https://qm.ycombinator.com/); release date, Quartermaster name, internal history and product goal.
2. [yc-software/qm repository](https://github.com/yc-software/qm); features, architecture, supported harnesses, deployment overview, license, tags and repository activity.
3. [QM security policy and threat model](https://raw.githubusercontent.com/yc-software/qm/main/SECURITY.md); trust boundaries, controls and known limitations.
4. [QM getting-started guide](https://raw.githubusercontent.com/yc-software/qm/main/docs/getting-started.md); organization deployment, cloud targets, identity and connector setup.
5. [QM deployment workflow](https://raw.githubusercontent.com/yc-software/qm/main/cli/templates/deployment/deployment.md); prerequisites, operator approvals, provider choices and live verification.
6. [QM CLI package manifest](https://raw.githubusercontent.com/yc-software/qm/main/cli/package.json); deployable CLI version, runtime requirement, package provenance and commands.

*Status checked 11 August 2026. QM is changing quickly. Verify the current package, documentation and threat model before making an architecture or purchasing decision.*

## Final thoughts

QM is interesting because it starts where personal agents usually break: identity, separate scopes, shared rooms, durable work and centralized policy. For a technical startup, that is a much more useful foundation than another impressive chat demo.

The trade is ownership. The same design that avoids a hosted black box makes your team responsible for infrastructure, credentials, access, retention, model spend and incident response. Pilot one reversible workflow, test the boundaries harder than the happy path, and scale only when accepted business output improves without hiding risk in human review.

## You may also like..

[**MCP Is Not a Security Boundary** See where deterministic authorization must sit when agents can reach company data through several paths.](/blog/mcp-security-boundary-data-level-access-control/) [**AI enablement vs generic AI consulting** Compare an owned, working AI operating model with a strategy-only engagement.](/compare/ai-enablement-vs-generic-ai-consultancy/)

Agent engineering

## Continue through this cluster

Coding agents, MCP, context systems, evaluation and the controls required for dependable automation.

[Start with the cornerstone**Graph Engineering for AI Agents: When Does a Knowledge Graph Pay Off?**](/blog/graph-engineering-ai-agents/)

- [OpenViking Review 2026: Is Filesystem Memory Production-Ready?](/blog/openviking-agent-memory-review/)
- [LLM-as-a-Verifier Explained: Architecture, Costs, and Production Fit](/blog/llm-as-a-verifier/)
- [TrueForge Review: Is the Open-Source Agent Harness Production-Ready?](/blog/trueforge-agent-harness-review/)
- [Agent-Readable Websites: llms.txt, Markdown Mirrors and What Breaks](/blog/agent-readable-website-llms-txt-markdown-mirrors/)
- [Localized URLs Break hreflang: Keep One English Slug](/blog/english-slugs-vs-localized-urls-hreflang/)

Inbox, without the noise

## Follow the work that matters to you

Get a short email when we publish something new. Follow the whole blog or only the problems you care about.

[**Back**](/blog/overview/)

[![Kevin Riedl](/img/team/kevin.webp)](/team/kevin-riedl/)

[Kevin Riedl](/team/kevin-riedl/) https://linkedin.com/in/wsdt

12 min read · 2 Aug 2026 Last reviewed August 11, 2026

[**Next**](/blog/multi-model-ai-coding-agent-stack-2026/)

New posts by email ×

×

Get new posts by email

A short email when we publish. Free, no tracking.

## Structured Data

```json
{
  "@context": "https://schema.org",
  "@graph": [
    {
      "@id": "https://wavect.io/#organization",
      "@type": [
        "Organization",
        "ProfessionalService",
        "LocalBusiness"
      ],
      "employee": [
        {
          "@id": "https://wavect.io/team/kevin-riedl/#person",
          "@type": "Person",
          "jobTitle": "Managing Director",
          "name": "Kevin Riedl",
          "url": "https://wavect.io/team/kevin-riedl/",
          "worksFor": {
            "@id": "https://wavect.io/#organization",
            "@type": [
              "Organization",
              "ProfessionalService",
              "LocalBusiness"
            ]
          }
        },
        {
          "@id": "https://wavect.io/team/christof-jori/#person",
          "@type": "Person",
          "jobTitle": "Managing Director",
          "name": "Christof Jori",
          "url": "https://wavect.io/team/christof-jori/",
          "worksFor": {
            "@id": "https://wavect.io/#organization",
            "@type": [
              "Organization",
              "ProfessionalService",
              "LocalBusiness"
            ]
          }
        }
      ],
      "founder": [
        {
          "@id": "https://wavect.io/team/kevin-riedl/#person",
          "@type": "Person",
          "jobTitle": "Managing Director",
          "name": "Kevin Riedl",
          "url": "https://wavect.io/team/kevin-riedl/",
          "worksFor": {
            "@id": "https://wavect.io/#organization",
            "@type": [
              "Organization",
              "ProfessionalService",
              "LocalBusiness"
            ]
          }
        },
        {
          "@id": "https://wavect.io/team/christof-jori/#person",
          "@type": "Person",
          "jobTitle": "Managing Director",
          "name": "Christof Jori",
          "url": "https://wavect.io/team/christof-jori/",
          "worksFor": {
            "@id": "https://wavect.io/#organization",
            "@type": [
              "Organization",
              "ProfessionalService",
              "LocalBusiness"
            ]
          }
        }
      ],
      "legalRepresentative": [
        {
          "@id": "https://wavect.io/team/kevin-riedl/#person",
          "@type": "Person",
          "jobTitle": "Managing Director",
          "name": "Kevin Riedl",
          "url": "https://wavect.io/team/kevin-riedl/",
          "worksFor": {
            "@id": "https://wavect.io/#organization",
            "@type": [
              "Organization",
              "ProfessionalService",
              "LocalBusiness"
            ]
          }
        },
        {
          "@id": "https://wavect.io/team/christof-jori/#person",
          "@type": "Person",
          "jobTitle": "Managing Director",
          "name": "Christof Jori",
          "url": "https://wavect.io/team/christof-jori/",
          "worksFor": {
            "@id": "https://wavect.io/#organization",
            "@type": [
              "Organization",
              "ProfessionalService",
              "LocalBusiness"
            ]
          }
        }
      ],
      "name": "Wavect GmbH",
      "subjectOf": {
        "@id": "https://wavect.io/verified-claims.json#dataset",
        "@type": "Dataset",
        "creator": {
          "@id": "https://wavect.io/#organization",
          "@type": [
            "Organization",
            "ProfessionalService",
            "LocalBusiness"
          ]
        },
        "description": "A machine-readable registry of quantitative and qualitative claims published by Wavect, with review dates, localized page appearances and public third-party citations where available.",
        "inLanguage": "en",
        "isAccessibleForFree": true,
        "license": "https://creativecommons.org/licenses/by/4.0/",
        "name": "Wavect verified publication claims",
        "url": "https://wavect.io/verified-claims.json"
      },
      "url": "https://wavect.io/"
    },
    {
      "@id": "https://wavect.io/team/kevin-riedl/#person",
      "@type": "Person",
      "jobTitle": "Managing Director",
      "name": "Kevin Riedl",
      "sameAs": [
        "https://www.wikidata.org/wiki/Q139796365",
        "https://www.linkedin.com/in/wsdt",
        "https://github.com/wsdt"
      ],
      "url": "https://wavect.io/team/kevin-riedl/",
      "worksFor": {
        "@id": "https://wavect.io/#organization",
        "@type": [
          "Organization",
          "ProfessionalService",
          "LocalBusiness"
        ]
      }
    },
    {
      "@id": "https://wavect.io/team/christof-jori/#person",
      "@type": "Person",
      "jobTitle": "Managing Director",
      "name": "Christof Jori",
      "sameAs": [
        "https://www.wikidata.org/wiki/Q139796367",
        "https://www.linkedin.com/in/jocr77/",
        "https://github.com/jo-chris"
      ],
      "url": "https://wavect.io/team/christof-jori/",
      "worksFor": {
        "@id": "https://wavect.io/#organization",
        "@type": [
          "Organization",
          "ProfessionalService",
          "LocalBusiness"
        ]
      }
    },
    {
      "@id": "https://wavect.io/#website",
      "@type": "WebSite",
      "inLanguage": [
        "en",
        "de",
        "es",
        "zh"
      ],
      "name": "Wavect",
      "potentialAction": {
        "@type": "SearchAction",
        "query-input": "required name=search_term_string",
        "target": {
          "@type": "EntryPoint",
          "urlTemplate": "https://wavect.io/search/?q={search_term_string}"
        }
      },
      "publisher": {
        "@id": "https://wavect.io/#organization",
        "@type": [
          "Organization",
          "ProfessionalService",
          "LocalBusiness"
        ]
      },
      "url": "https://wavect.io/"
    },
    {
      "@id": "https://wavect.io/blog/qm-ai-agent-harness-review/#webpage",
      "@type": "WebPage",
      "dateModified": "2026-08-02",
      "inLanguage": "en",
      "isPartOf": {
        "@id": "https://wavect.io/#website",
        "@type": "WebSite"
      },
      "lastReviewed": "2026-08-02",
      "url": "https://wavect.io/blog/qm-ai-agent-harness-review/"
    }
  ]
}
```

```json
{
  "@context": "https://schema.org",
  "@type": "BlogPosting",
  "abstract": "QM, short for Quartermaster, is Y Combinator's primarily MIT-licensed multiplayer agent harness for company work. It gives each employee, room and project an isolated scope for memory, files, credentials, permissions, schedules, apps and sandboxed execution, while a central core handles identity, policy and audit. The current project supports Slack and web surfaces, Pi, OpenCode, Codex and Claude Code harnesses, shared skills, background work, and organization-owned deployments on Fly.io or AWS. QM is promising for a technical startup that can operate the infrastructure and start with a narrow, reversible workflow. It is not turnkey SaaS or a hardened public multi-tenant boundary. Treat it as a pilot platform and measure accepted task completion, review effort, cost and cross-scope incidents before production.",
  "articleBody": " Blog overview/AI and agents/Agent engineering YC QM Agent Review: Is Quartermaster Ready for Work? TL;DR QM, short for Quartermaster, is Y Combinator's primarily MIT-licensed multiplayer agent harness for company work. It gives each employee, room and project an isolated scope for memory, files, credentials, permissions, schedules, apps and sandboxed execution, while a central core handles identity, policy and audit. The current project supports Slack and web surfaces, Pi, OpenCode, Codex and Claude Code harnesses, shared skills, background work, and organization-owned deployments on Fly.io or AWS. QM is promising for a technical startup that can operate the infrastructure and start with a narrow, reversible workflow. It is not turnkey SaaS or a hardened public multi-tenant boundary. Treat it as a pilot platform and measure accepted task completion, review effort, cost and cross-scope incidents before production. QM, also called Quartermaster or the YC QM agent, is an open-source harness for giving employees and shared rooms isolated AI workspaces under one company control plane. It can connect Pi, OpenCode, Codex, or Claude Code to Slack and the web, with separate memory, files, credentials, permissions, schedules, and sandboxes for each scope. Our verdict after reviewing the current code, deployment documentation, release metadata, and threat model on 11 August 2026: QM is worth a bounded 30-day pilot for a technical startup with a narrow internal workflow and platform-engineering capacity. It is not turnkey SaaS, a hardened public multi-tenant boundary, or a safe default for unattended high-impact actions. We did not deploy or benchmark QM for this review, so performance and operating-cost claims would be speculation. This article targets the product-specific question, not the broader orchestration keyword. For the human supervision constraint, read our analysis of the focus bottleneck when teams run multiple AI agents. For the authorization layer, see why MCP is not a data security boundary. What is QM by Y Combinator? QM, short for Quartermaster, is an MIT-licensed multiplayer agent harness released by Y Combinator in July 2026. YC says it built QM after experimenting with an internal agent loop and then operating more than 50 individual Hermes agents. The goal is to combine a flexible personal agent with administration for a whole organization. The official YC announcement describes employees and projects receiving agents as needed. \"Multiplayer\" does not mean that several models debate in one chat. It means multiple people can have private agent scopes and collaborate with shared scopes in Slack channels, group messages or projects. According to the QM repository, each person and room gets its own memory, workspace, credential view, permissions, schedules, apps and durable sandbox. QM layerWhat it ownsBuyer implication CoreAPI, identity, policy, scheduler and agent loopOne control plane must be operated and secured ScopePerson, room or project context and grantsCollaboration does not require one global memory SandboxFiles, tools, commands and logged-in servicesUseful work is possible, but credentials and execution create risk Harness adapterPi, OpenCode, Codex or Claude CodeThe organization can change harnesses without replacing the core Surface pluginSlack, web UI, admin panel or public portalChannels are optional interfaces, not the source of truth What problem does QM solve that a personal agent does not? A personal agent assumes one user, one set of credentials and one context owner. A company has conflicting requirements: Alice's email token must not appear in Bob's sandbox, a channel needs shared memory, admins need policy control, scheduled work must survive a browser tab, and every side effect needs attribution. QM makes those concerns explicit. A central Postgres layer stores sessions, memory and queued work. A headless TypeScript core runs policy and the agent loop. Each scope gets an execution environment. Slack and the web app sit on top as optional surfaces. This is a stronger starting architecture than placing one powerful bot token behind a shared channel and hoping the prompt keeps users separated. The important distinction is multi-user isolation, not multi-agent spectacle. That exact intent is underserved in current search results, which often mix team agents, agent swarms, chatbots and workflow builders into one category. Who should evaluate QM, and who should wait? Pilot QM now whenWait or choose another route when You are a technical startup with an internal Slack-first workflowYou need a managed product with an SLA and vendor support You want infrastructure and data in your own Fly.io or AWS accountYou require on-premises, air-gapped or another cloud target today You need private employee scopes plus shared project scopesYour use case is a public, multi-tenant customer agent You can assign an operator for upgrades, incidents and access reviewsNobody owns the control plane after",
  "articleSection": "Engineering",
  "author": {
    "@id": "https://wavect.io/team/kevin-riedl/#person",
    "@type": "Person",
    "name": "Kevin Riedl",
    "sameAs": [
      "https://www.wikidata.org/wiki/Q139796365",
      "https://www.linkedin.com/in/wsdt",
      "https://github.com/wsdt"
    ],
    "url": "https://wavect.io/team/kevin-riedl/"
  },
  "citation": [
    {
      "@type": "WebPage",
      "name": "Y Combinator: QM announcement",
      "url": "https://qm.ycombinator.com/"
    },
    {
      "@type": "WebPage",
      "name": "yc-software/qm repository",
      "url": "https://github.com/yc-software/qm"
    },
    {
      "@type": "WebPage",
      "name": "QM security policy and threat model",
      "url": "https://raw.githubusercontent.com/yc-software/qm/main/SECURITY.md"
    },
    {
      "@type": "WebPage",
      "name": "QM getting-started guide",
      "url": "https://raw.githubusercontent.com/yc-software/qm/main/docs/getting-started.md"
    },
    {
      "@type": "WebPage",
      "name": "QM deployment workflow",
      "url": "https://raw.githubusercontent.com/yc-software/qm/main/cli/templates/deployment/deployment.md"
    },
    {
      "@type": "WebPage",
      "name": "QM CLI package manifest",
      "url": "https://raw.githubusercontent.com/yc-software/qm/main/cli/package.json"
    }
  ],
  "dateModified": "2026-08-11",
  "datePublished": "2026-08-02",
  "description": "QM, short for Quartermaster, is Y Combinator's primarily MIT-licensed multiplayer agent harness for company work. It gives each employee, room and project an isolated scope for memory, files, credentials, permissions, schedules, apps and sandboxed execution, while a central core handles identity, policy and audit. The current project supports Slack and web surfaces, Pi, OpenCode, Codex and Claude Code harnesses, shared skills, background work, and organization-owned deployments on Fly.io or AWS. QM is promising for a technical startup that can operate the infrastructure and start with a narrow, reversible workflow. It is not turnkey SaaS or a hardened public multi-tenant boundary. Treat it as a pilot platform and measure accepted task completion, review effort, cost and cross-scope incidents before production.",
  "headline": "YC QM Agent Review: Is Quartermaster Ready for Work?",
  "image": "https://wavect.io/img/blog/headers/header_qm-ai-agent-harness-review.svg",
  "inLanguage": "en",
  "keywords": "AI Agents, Open Source",
  "mainEntityOfPage": {
    "@id": "https://wavect.io/blog/qm-ai-agent-harness-review/",
    "@type": "WebPage"
  },
  "publisher": {
    "@id": "https://wavect.io/#organization",
    "@type": [
      "Organization",
      "ProfessionalService",
      "LocalBusiness"
    ]
  },
  "url": "https://wavect.io/blog/qm-ai-agent-harness-review/",
  "wordCount": 2527
}
```

```json
{
  "@context": "https://schema.org",
  "@type": "BreadcrumbList",
  "itemListElement": [
    {
      "@type": "ListItem",
      "item": "https://wavect.io/",
      "name": "Home",
      "position": 1
    },
    {
      "@type": "ListItem",
      "item": "https://wavect.io/blog/overview/",
      "name": "Blog overview",
      "position": 2
    },
    {
      "@type": "ListItem",
      "item": "https://wavect.io/blog/topics/ai-agents/",
      "name": "AI and agents",
      "position": 3
    },
    {
      "@type": "ListItem",
      "item": "https://wavect.io/blog/clusters/agent-engineering/",
      "name": "Agent engineering",
      "position": 4
    },
    {
      "@type": "ListItem",
      "item": "https://wavect.io/blog/qm-ai-agent-harness-review/",
      "name": "YC QM Agent Review: Quartermaster for Work | ",
      "position": 5
    }
  ]
}
```

```json
{
  "@context": "https://schema.org",
  "@type": "FAQPage",
  "mainEntity": [
    {
      "@type": "Question",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "QM is short for Quartermaster. Y Combinator uses the name for its open-source multiplayer agent harness for company work, not quality management software."
      },
      "name": "What does QM stand for?"
    },
    {
      "@type": "Question",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "No. QM is an agent harness and control plane. It can run several model and harness combinations, including Pi, OpenCode, Codex and Claude Code, while keeping organizational state and policy in a shared core."
      },
      "name": "Is QM an AI model?"
    },
    {
      "@type": "Question",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yes. The repository is primarily MIT-licensed, and deployments run in the operator's own cloud account. The documented production targets are Fly.io and AWS; local Docker is positioned as a test path."
      },
      "name": "Is QM open source and self-hosted?"
    },
    {
      "@type": "Question",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Not by default. The project calls itself early, experimental software and documents material security limitations. A production decision needs deployment-specific security, operational and compliance review."
      },
      "name": "Is QM production-ready?"
    },
    {
      "@type": "Question",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yes. Slack is an optional plugin and can provide agent interaction or sign-in. The web UI, admin panel and portal are separate optional surfaces over the same core."
      },
      "name": "Does QM support Slack?"
    },
    {
      "@type": "Question",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "The strongest fit is a technical startup that wants private employee scopes plus shared project or Slack scopes, accepts owner-operated infrastructure and can start with a narrow, reversible internal workflow."
      },
      "name": "Who should evaluate QM?"
    }
  ]
}
```