QM: a vendor-neutral, multiplayer AI agent harness for startups in Slack and the web

QM, released by yc-software under the MIT license, rethinks the workplace AI agent as a multi-tenant system rather than a single personal assistant. Every employee gets an isolated workspace — its own scoped memory, files, credentials, permissions, scheduled jobs, web apps, and a durable sandbox that persists installed tools — while still collaborating with the agent in shared Slack channels, group messages, and projects. The same identity and configuration follow a user between Slack and the web app, and admins set org-wide policy, including which models and harnesses are available.

The design is deliberately vendor-agnostic. A headless TypeScript core (Node plus Fastify, backed by Postgres for sessions, memory, and a work queue) drives a pluggable agent loop that can run Pi, OpenCode, Codex, or Claude Code, so a deployment isn’t locked to one model provider. Every substrate — harness, session store, sandbox, memory — sits behind an interface swapped in through a single wiring file. The agent works with a small fixed tool surface whose key primitive is an execute tool that runs commands inside each scope’s own sandbox. Web, admin, and portal UIs are optional plugins over the core’s HTTP API, and Slack runs as a supervised in-process plugin.

Security is posture-driven: an org picks Strict (human approval on every tool call), Auto (a classifier screens provenance-labeled external data before it reaches the model), or Dangerous (no screening), and narrower scopes can only tighten the choice. A predeclared command policy blocking things like recursive deletes and destructive SQL applies even in Dangerous mode. Deployments run in the operator’s own cloud via the qm CLI with no source checkout required, contributions are accepted as written proposals rather than code, and organizations that want the full codebase in-house are steered toward a plain private clone instead of a GitHub fork — because a GitHub fork of a public repo can’t be made private and shares an object network that leaves pushed commits fetchable from the public side.