yc-software/qm

Overview

QM is a self-hosted harness for running AI agents across a team. Instead of one shared assistant, every employee gets an isolated workspace with its own memory, files, keychain view, permissions, cron jobs, web apps, and durable sandbox. The same identity follows a person between Slack and the built-in web app, and shared channels or projects act as collaborative rooms where several people work with the agent together.

The core is deliberately generic. A central service handles authentication, policy, scheduling, and the agent loop (runs on Pi, which supports many model providers), with Postgres storing sessions, memory, and the queue. Each scope gets its own sandbox where the execute tool runs commands. Organization-specific configuration, custom tools, skills, and infrastructure live in a deployment directory rather than in core. Memory can be routed to external providers per scope while keeping the built-in notebook.

It is aimed at startups and small orgs that want a company-wide agent without handing everything to a hosted vendor: you deploy into your own cloud account and choose your own models and keys.

Quick start

Prerequisites: Node 24.15 or later and a Postgres instance for DATABASE_URL.

To create an organization-owned deployment repository:

npm exec --yes --package=@yc-software/qm@latest -- \
  qm init . --org <slug> --target <fly-or-aws>
npm install

Initialization generates a deployment skill for an agent and walks through infrastructure, web sign-in, connector credentials, optional Slack access, deployment, and live verification; no source checkout is needed. Detailed provider setup is in the deployment guide and a first end-to-end run is described in the getting-started doc.

For local development against a real model and real Postgres, the dev-instance scripts start the web UI or Slack surface:

npm run dev-instance:web    # web UI and settings
npm run dev-instance:slack  # Slack
npm run dev-instance:both   # both surfaces together

A third-party hosted trial is available at Agent37 if you want to evaluate before deploying.

Security model

QM follows the local coding-agent pattern: the agent acts as the person it works for, with that person's credentials and permissions, and its actions are audited. An org selects one posture — Strict (approve every tool call), Auto (default, blocks private-network access), or Dangerous (no approval gates, screening only observes). Content screening is a separate deployment setting with off, observe, and enforce modes. A predeclared command policy denying destructive operations (recursive deletes, destructive SQL) applies in every posture, and sharing can be Isolated (default) or Open. The threat model and known limitations are worth reading before deploying.

Constraints and customization

Postgres is mandatory for core and for tests (DATABASE_URL=<disposable Postgres> npm test creates throwaway databases per test file). Deployment configuration, tools, skills, and infrastructure belong in deploy/layers/<org>/ in a private fork or a separate private deployment repository, and secrets must never be committed. Editing source alone does not change a deployed runtime unless you build from the checkout with the in-tree CLI (check, plan, up, then check --live).

Contributions are accepted as human-written design notes in adrs/, not as pull requests with code — the maintainers implement aligned proposals themselves, and vulnerabilities should be reported privately rather than as public issues.

HotRepo's take

The project drew 682 points and 163 comments on Hacker News in late July 2026, and much of the discussion focused on scoping rather than the agent loop: one commenter working on a similar team harness called per-person scopes plus shared rooms "a sane answer" for a company-wide assistant comment. That matches where QM puts its design weight — isolated scopes, durable sandboxes, and a Postgres-backed session store — rather than model routing, which is deliberately pluggable.

The most visible criticism in the thread targeted a shipped "anti-slop" frontend skill, with one commenter calling a 22,069-token skill a major issue and questioning trust in a harness that ships it reply. Another noted that the product page took digging to understand comment, a common complaint about this generation of agent tools. For adopters, the practical takeaway is that QM is a deployment-heavy, operator-oriented system: budget time for infrastructure, Postgres, and security posture decisions before expecting a working team agent.