Y Combinator has open-sourced QM, an agent-workflow platform that lets startups customise AI-agent operations, tools, and security controls around their specific needs.
Y Combinator has introduced QM, an open-source multiplayer agent harness designed to centralise startup workflows and coordinate work across distributed teams. Its cloud-based architecture combines isolated workspaces, Slack integration, shared memory, files, and tools in a unified environment.
The key open-source advantage is customisation. Startups can modify QM and its agent harnesses to suit specific workflows, controlling which tools agents can access for software development, operational management, data analysis, and reporting. This positions QM as an open-source infrastructure layer for collaborative AI-agent workflows rather than a fixed commercial workflow tool.
PostgreSQL underpins QM, supporting session-history storage and agent loops that allow teams to revisit previous actions and maintain workflow continuity. Shared and private spaces also help manage tools, credentials, and sensitive information.
QM provides three levels of agent-action control: Strict restricts agents to predefined safe commands; Auto permits commands within a controlled scope; and Dangerous allows potentially harmful actions, such as recursive deletes and destructive SQL queries, only with explicit administrative approval. Command policies provide further control over permitted agent actions.
However, QM has usability limitations, including unclear interface context and administrative tasks that can require API calls. Better documentation and simpler administrative tools could broaden adoption.
Still in its early stages, QM gives startups and the wider open-source community scope to customise agent-driven workflows while retaining control over agent behaviour, tools, and security.
