QM

What it is

QM — short for Quartermaster — is Y Combinator’s internal agent harness, open-sourced under the MIT license on 31 July 2026. YC runs it across its own accounting, legal, events, and engineering work, and the public repo at github.com/yc-software/qm passed 15,000 stars within two months. The launch post on Hacker News reached 682 points and 163 comments, with most of the thread arguing QM against OpenClaw, Hermes, and Claude Cowork.

The design choice that separates it from those tools is multiplayer. OpenClaw is one person’s agent on one person’s Gateway. QM gives every employee a private agent workspace and gives every Slack channel, group DM, and project its own shared agent. Each of those scopes owns its memory, files, keychain view, permissions, crons, web apps, and a durable sandbox, and resources stay in the owning scope unless someone explicitly shares them. An organization scope above them sets defaults and policy ceilings.

It is not a SaaS product. You run it in your own cloud account, with your own model keys. qm init scaffolds a deployment repo targeting Fly.io or AWS (ECS Fargate plus Lambda MicroVMs); the core is TypeScript on Fastify with Postgres for sessions, memory, and the durable queue. The agent loop itself is pluggable — Pi, OpenCode, Codex, and Claude Code can each drive the same core — so switching model vendors is a config change, not a migration.

Why it lands on shortlists

• Shared agents without a shared bot token. The usual way a team “shares” an agent is one Slack bot with one set of credentials that everyone can talk to. QM maps Slack identity to QM principals, so the agent in #legal-intake acts with that channel’s grants and the agent in your DMs acts with yours. For a legal or finance team that is the difference between a pilot security can approve and one it can’t.
• Background work is first-class. Crons re-run a prompt on a calendar or polling schedule, process watches report long-running jobs back into a conversation, and inbound webhooks let an external system wake a turn with a verified event. That covers the ops patterns that matter — a weekly pipeline-hygiene sweep, a contract-renewal watch, an ATS webhook that triggers candidate summaries — without a separate automation tool.
• Skills and apps are shareable assets. Skills are scope-owned instruction packages, shareable by grant and promotable org-wide, importable from git. Apps are internal web apps with a stable URL, immutable versions, access grants, and rollback — the agent can build the intake form and publish it to the people who need it.
• Approval posture is an admin setting. Strict pauses every tool call for human approval; Auto (the default) blocks private-network access and screens content; Dangerous removes gates. Command-policy rules apply as hard denials in every posture, and agent actions are audit-logged. MCP servers register as shared connectors, and QM applies its own scope rules before exposing their tools.

What it costs

The software is $0. There is no published hosting estimate, and anyone quoting a monthly figure is guessing about your workload. The bill has four lines: cloud compute and managed Postgres on Fly.io or AWS; the sandbox backend (E2B, Modal, Sprites, and Smolmachines are supported); model tokens, billed directly by your provider; and — the line people leave out — the platform engineer who owns upgrades, identity, backups, and access reviews. Release v0.1.13 (27 September 2026) added an admin spend dashboard and per-cron runtime overrides, so token spend is at least visible from inside the product.

For contrast on the managed side: Dust Pro seats are €24 per month billed yearly, Lindy Plus is $29.99 per user per month, and a Claude Team standard seat is $25 per month. At 20 seats that is roughly $500-$600 a month before overages. QM wins on cash only once those seat lines exceed your hosting bill plus a meaningful slice of an engineer’s time.

Best for

• Startups of roughly 10-500 people with at least one platform engineer, already Slack-first, that want ops, legal, and finance staff on shared agents without sending source systems to a third-party agent cloud
• RevOps and legal-ops teams that need channel-scoped agents — a deal-desk channel agent, a contract-intake agent — with crons and webhooks attached
• Teams already running OpenClaw for individuals who have hit its one-trust-boundary-per-Gateway limit

Alternatives — and when to pick them instead

• OpenClaw — pick it when the agent is for one person. One daemon on a laptop or small VPS is far less to operate than QM’s cloud deployment, and its own docs say a shared team Gateway is outside the design anyway.
• Dust — pick it when procurement needs a vendor to countersign. SOC 2 Type II, SSO, US/EU data residency, and a DPA on Enterprise answer questions QM hands back to you.
• Claude Cowork and ChatGPT business plans — the assistants most companies already license, and the market-share leaders QM is measured against. Pick them when you are standardised on one model lab and nobody will own infrastructure.
• Lindy — pick it when the builders are non-engineers and a pooled credit model is easier to budget than a cloud bill.
• QM is itself the fastest-growing entrant here, at 15,000 stars in under two months — a reason to pilot it, and a reason to pin a release.

Watch-outs

• The project calls itself early, experimental software. SECURITY.md says its design goal is “not a promise that data cannot leak” and not a substitute for a deployment-specific review; releases are still in the 0.1.x range and shipping weekly. Guard: pin the @yc-software/qm version in your deployment repo, use the plan command before every upgrade, and run your own security review before regulated data moves.
• It does not protect you from your own operator or admins. The threat model assumes one organization of authenticated internal users; admins can read sensitive scope content (audited, not consent-gated), and sandbox credentials sit in plaintext while in use. Guard: keep the operator role to one or two named people, put privileged legal matters in a separate deployment, and review the admin audit log monthly.
• Command policy is a speed bump, not a wall. The project says so directly, and browser actions bypass the core gates and egress proxy. Guard: start new scopes in Strict posture with read-only or draft-only skills, and move to Auto only after a few weeks of reviewed runs.
• No vendor means no SLA. YC Software maintains it with no published support commitment, and contributions are requested as written proposals rather than pull requests. Guard: budget a named owner with standing time for upgrades, and if you can’t name that person, buy Dust or Cowork instead.