QM is an open-source AI agent platform from Y Combinator for startups and internal teams.
It runs through Slack and a web app. Every employee, chat room, and project receives a separate workspace with its own memory, files, credentials, permissions, scheduled jobs, web apps, and persistent sandbox.
The platform connects Pi, OpenCode, Codex, and Claude Code to one central system. An organization selects the available agent backends and models. Employees complete private work inside personal scopes. Teams work with the agent inside shared channels and project scopes.
QM runs inside infrastructure controlled by the organization. Deployment requires Node.js, a supported hosting target, model-provider credentials, authentication configuration, and ongoing system administration.
The source code is released under the MIT license. Model usage, hosting, databases, storage, email delivery, browser services, and connected APIs produce separate operating costs.
How QM Organizes Agent Work
QM creates a scope for each person, Slack room, group conversation, or project. The scope determines which memory, files, credentials, tools, permissions, skills, and scheduled tasks the agent receives.
A personal task runs with the employee’s authorized resources. Activity inside a shared channel uses the channel’s scope. Files and installed tools persist inside the assigned sandbox across sessions.
| Scope | Included Resources | Typical Work |
|---|---|---|
| Personal scope | Private memory, files, credentials, tools, skills, crons, and sandbox | Email triage, research, coding, document work |
| Shared room | Room memory, shared files, granted skills, project permissions, and scheduled tasks | Team research, follow-ups, project updates |
| Project scope | Project history, repositories, tools, documents, and automation | Development work, status tracking, internal operations |
| Organization configuration | Approved models, agent backends, security posture, plugins, and policies | Administration and access control |
| Published web app | App code, selected data access, environment settings, and audience rules | Internal dashboards and task-specific applications |
Key Features
- Personal and shared scopes: Every employee and room receives separate memory, files, permissions, credentials, scheduled work, and sandbox resources.
- Slack and web interfaces: The same identity and configuration operate across both access points.
- Multiple agent backends: Pi, OpenCode, Codex, and Claude Code connect to the same QM core.
- Persistent sandboxes: Installed tools, local files, and working state survive between sessions.
- Organization controls: Administrators select models, agent backends, plugins, policies, and security settings.
- Shared skills: Skill owners grant access to other scopes. Organization-wide promotion requires administrator approval.
- Git-based skill packs: Deployments import collections of skills from Git repositories.
- Scheduled work: Crons run recurring tasks. Watches start work after a configured condition or event.
- Internal web apps: Agents create applications and publish them to selected users.
- Audited actions: QM records security-relevant activity across scopes and connected systems.
What Teams Do with QM
Search Internal Knowledge
A personal scope connects authorized notes, email, documents, databases, and web search. An employee asks one question and receives an answer based on the resources available to that scope.
A project channel builds a separate record from conversations, uploaded files, completed tasks, and stored memory. The agent returns to the same project context during later sessions.
Triage Email on a Schedule
QM accesses an employee’s mailbox through granted credentials. A scheduled job reviews new messages, applies labels, and prepares reply drafts. Writing examples from earlier messages provide style context for those drafts.
Work in Software Repositories
A development scope opens an existing repository inside its sandbox. Codex, Claude Code, OpenCode, or Pi runs tests, edits files, checks logs, opens pull requests, and monitors CI. Updates return to the related Slack conversation or web session.
Track Shared Projects
A team stores project discussions, decisions, documents, and follow-up tasks inside a shared scope. Scheduled jobs post status reports. Watches respond to repository activity, new files, system events, or other configured changes.
Build Internal Applications
The agent creates small web applications for internal data and recurring workflows. The owner selects the audience and publishes the app through QM’s application portal. Each app receives its own runtime boundary and configured access.
QM Architecture
Every request passes through a headless core responsible for identity, policy, scheduling, and the agent loop. PostgreSQL stores sessions, memory, queues, and other durable state. The selected agent backend operates inside the scope’s sandbox through a fixed tool interface.
The web interface, admin panel, public portal, and Slack connection attach to the core as separate surfaces. Slack runs as an optional plugin. The core uses TypeScript, Node.js, and Fastify. The Slack integration uses Bolt. The web interface uses Vite and Lit.
Company-specific resources live in a deployment directory:
qm.config.jsonc
package.json
package-lock.json
deployment.md
.env.example
.env
slack-app-manifest.yml
slack-sso-manifest.yml
sandbox/
Dockerfile
tools/
skills/
plugins/
infra/The directory stores organization configuration, tools, skills, plugin images, sandbox customizations, infrastructure files, and secret names. Secret values stay in the ignored .env file or the selected hosting platform’s secret store.
QM Requirements
QM is a self-hosted system for teams that already manage technical infrastructure.
The deployment CLI runs separately from the QM runtime. Docker hosts local services. Fly.io uses Fly apps and Fly Machines. AWS uses ECS Fargate services and Lambda MicroVM agent computers.
| Requirement | Details |
|---|---|
| Node.js | Node.js 24 |
| Package | @yc-software/qm from npm |
| Hosting targets | Docker, Fly.io, or AWS |
| Production database | PostgreSQL |
| Model credentials | Keys or credentials for the selected model providers |
| Authentication | Built-in email-link authentication or an external identity provider |
| Email delivery | Resend or SMTP for built-in authentication |
| Slack credentials | Bot and app credentials when Slack is enabled |
| Deployment tools | Git plus Docker Buildx, Flyctl, or AWS CLI for the selected target |
| Operations | Monitoring, backups, upgrades, secrets, budgets, and incident handling |
How to Deploy QM
Create a Deployment Repository
Create an empty organization-owned repository. Run the initializer from its root directory:
npm exec --yes --package=@yc-software/qm@latest -- \
qm init . --org <slug> --target <fly-or-aws>
npm installReplace <slug> with the organization identifier. Select fly or aws for the production target.
The initializer creates the deployment directory, infrastructure files, environment template, sandbox structure, generated Slack manifests, and an agent-readable deployment skill.
Validate the Deployment Files
npm exec qm -- check
npm exec qm -- doctorcheck validates local configuration, secret names, tools, skills, and plugins. doctor performs read-only checks against external services and infrastructure requirements.
Prepare the Runtime Image
Use the command required by the selected hosting target:
npm exec qm -- sandbox publishAWS deployments use the infrastructure image path:
npm exec qm -- infra build-imageThe build records image digests and connects the resulting sandbox layer to the deployment configuration.
Review the Deployment Plan
npm exec qm -- planThe plan renders the upcoming infrastructure and service changes before mutation.
Start QM
npm exec qm -- up --yesThe command creates or updates the long-running services for the selected hosting provider.
Run Live Checks
npm exec qm -- check --liveThe live check verifies the deployed services and external connections.
Configure Web Sign-In
The built-in authentication broker sends one-time login links by email. Add an administrator address, a verified sender, and Resend or SMTP credentials.
An external identity provider replaces the built-in broker. That provider must register the exact QM callback URL.
Add Slack
QM generates Slack application manifests during initialization. Create the Slack applications from those manifests, then add the bot and app tokens to the deployment secrets.
Slack is optional. The web interface operates through the core HTTP API.
Security Modes
An organization selects one of three security postures. The command policy applies in every mode. It contains approval rules and denials for known destructive operations such as recursive deletion and destructive SQL.
| Security Posture | Behavior |
|---|---|
| Strict | Agent tool calls pause for human approval, except no-effect turn-ending actions |
| Auto | A classifier screens supported external content and tool results before model access |
| Dangerous | Tool calls run with no content screening or approval pauses |
Security Limits to Review Before Deployment
QM is early experimental software. A production deployment needs a security review based on its users, credentials, connected systems, data sensitivity, model providers, browser services, and retention requirements.
Custom Tools and Skills
Each deployment adds company-specific tools and skills under sandbox/.
A tool directory contains a descriptor and its executable files:
sandbox/tools/<tool-id>/
tool.json
<binary>A skill directory contains instructions and supporting text assets:
sandbox/skills/<skill-id>/
SKILL.md
<text-assets>Shared skills belong to a scope. The owner grants access to selected users or rooms. Administrators approve promotion to the organization level. Git repositories supply reusable skill packs for larger deployments.
Pros
- Separate employee and project scopes
- Slack and web access
- Multiple agent backends
- Persistent sandbox environments
- Shared organization skills
- Scheduled tasks and watches
- Internal app publishing
- Operator-controlled infrastructure
- MIT-licensed source code
Cons
- Technical deployment requirements
- Ongoing cloud administration
- External model and service costs
- Credentials exposed during execution
- Incomplete security screening
Alternatives & Related Resources
- Hermes Agent: Free, Open-source, Self-Improving AI Agent
- Openclaw: Your 24/7 Personal AI Employee
- Open-Source AI Agent Orchestration for AI Companies – Paperclip
- Automate Anything: 10 Best & Open-source AI Agents
- 7 Best OpenClaw Alternatives for Safe & Local AI Agents
FAQs
Q: Does the Strict security posture ever skip human approval?
A: Only for two no-effect turn-enders. Every other tool call under Strict pauses for a person to approve it before it runs.
Q: Does each employee receive a separate agent?
A: Each employee receives a separate scope with independent memory, files, permissions, credentials, scheduled tasks, and sandbox resources. Shared rooms and projects receive their own scopes.
Q: Can I use QM without Slack?
A: Yes, the web UI provides a standalone interface for personal agents and admin tasks. Channel-scoped agents and collaborative features require Slack.
Q: How is QM different from running a shared Claude Code or Codex session?
A: A shared session has no user isolation, no scoped memory, and no admin policy layer. QM gives each person and each room a separate sandbox, memory, and tool set, while still allowing agent-to-agent interaction in shared channels. The admin can enforce security postures and approve skills globally.
Q: Can I deploy on Google Cloud or Azure?
A: The official CLI targets Fly.io and AWS. The core server is containerized and writes data to PostgreSQL, so you can adapt it to other platforms, but the automated setup and deployment tooling only supports the two listed targets.
