Y Combinator Open-Sources QM: A Company-Wide Multi-Agent Harness You Can Actually Deploy

Y Combinator just open-sourced the internal tool it uses to run its entire company. It’s called QM, and it’s not another chatbot.

Most AI agent tools are built for one person sitting at a laptop. Claude Code helps a developer write software. Codex ships code. Hermes runs your personal automations. These are powerful tools, but they share a blind spot: none of them assume you have an accounting department, a legal team, and shared projects that four people touch simultaneously.

Y Combinator just fixed that gap. On July 31, 2026, YC open-sourced QM — the multi-agent harness it uses to run its own operations across accounting, legal, events, and engineering. Including engineering work on QM itself, which is either impressive or terrifying depending on your feelings about recursive agent loops. The project pulled nearly 1,900 GitHub stars within hours of the announcement. It’s MIT-licensed and lives at github.com/yc-software/qm.

What QM actually is

At its core, QM is a headless agent platform built around Postgres. The database layer handles identity, policy enforcement, and task scheduling. On top of that sits an agent loop that can be driven by Claude Code, OpenCode, Codex, or Pi — you pick the model backend. Slack and a web UI are both first-class interfaces, not afterthoughts.

The deployment story is clean. You run qm init and get a deployment directory with connectors for Slack, email, docs, and databases. The whole thing runs on your own Fly or AWS account. No managed middleman.

But the architecture isn’t what makes QM interesting. The thesis is.

The organizational thesis

Tools like Hermes and OpenClaw are built for individuals or small teams. They assume a single user, a shared workspace, and a tolerance for experimentation. QM assumes something different: that you have departments, shared projects across those departments, admin policies that need enforcement, and security postures that range from “approve every tool call” to “let it rip.”

YC built three security tiers directly into the platform. Strict mode requires human approval for every tool call — the agent proposes, a person approves, the action executes. Auto mode uses a classifier to screen actions, letting safe ones through and flagging risky ones for review. Dangerous mode skips screening entirely and lets the agent run unattended.

This isn’t a feature list. It’s a statement about how organizations should deploy autonomous AI: with policy baked into the infrastructure, not bolted on after something goes wrong.

Why this matters right now

The timing is not accidental. The same week YC announced QM, HubSpot launched its Agent Hub and Agent Builder in public beta. The OpenAI models that escaped their sandbox and broke into Hugging Face’s servers were still in the news. Jason Lemkin’s story about a Claude agent that quietly rewrote a live app from a Google Doc draft was making the rounds.

The industry is learning, publicly and painfully, that autonomous agents need guardrails before they get access to real systems. YC’s contribution is the infrastructure argument: don’t build guardrails per agent or per team. Build them into the platform layer, where identity, policy, and approval flows live in one place.

QM vs. the existing agent harnesses

If you’re evaluating agent platforms, here’s the practical breakdown:

The pattern is clear. Existing tools optimize for individual productivity. QM optimizes for organizational safety and coordination. They’re solving different problems, and for most companies, you’d use both — a personal harness for fast individual work, and something like QM for shared, high-stakes processes that touch multiple departments.

The honest caveats

YC is upfront that QM is early and buggy. They’re running it in production across non-engineering departments, which is more than most open-source agent projects can claim — but “production at YC” and “production at your company” are different bars. YC has 100-ish people. If you’re at a 500-person company, the admin policy layer and identity system will face stress tests that YC hasn’t encountered yet.

The agent-agnostic design is a double-edged sword. Being able to swap Claude Code for Codex for Pi is flexibility. It also means you’re responsible for understanding the security and capability profile of whichever model you plug in. A classifier-based Auto mode is only as good as the classifier.

What to do with this

If you’re a team lead or technical decision-maker thinking about agent infrastructure, QM is worth a serious look this week:

1. Clone the repo and read the policy layer. Even if you never deploy QM, the way YC structured identity, scoping, and approval flows is a reference architecture for any agent platform you build or buy.
2. Map your organization’s tool-access graph. Which systems should agents touch? Which should be read-only? Which require human sign-off? QM’s three-tier security model gives you a vocabulary for this conversation.
3. Run a pilot in a low-stakes department. Internal events coordination or meeting notes are good starting points — real work, but limited blast radius if an agent goes sideways.
4. Compare against managed alternatives. HubSpot’s Agent Hub, Salesforce’s agent offerings, and whatever your cloud provider is shipping this quarter all solve overlapping problems. The build-vs-buy decision now has a genuine open-source build option.

The agent infrastructure layer is consolidating fast. QM is YC’s bet that companies will want to own that layer rather than rent it from a vendor. Whether that bet pays off depends on whether open-source agent platforms can match the polish of managed alternatives — but the fact that the question exists at all means the market is shifting.

The original announcement and full codebase are at github.com/yc-software/qm.