operations / agent

QM

A multiplayer agent harness for work, used in Slack and on the web, that you run in your own cloud with your own models and keys.

Repository owner yc-software

Not rated yet
0 comments

Like 0 Save

Published 11 Oct 2026Listing updated 12 Oct 2026

At a glance

Purpose: A multiplayer agent harness for work, used in Slack and on the web, that you run in your own cloud with your own models and keys.
Runs in: Web service
Operating systems: Not stated
Needs: Runtime: Node.js 24.15+; Needs internet: Yes; Needs accounts or API keys beyond your agent: Yes
Files and data: Reads files: Yes; Writes files: Yes; Sends data to other services: Yes
Tool type: Agent
Delivery: From GitHub
Version: Latest on the main branch
Access: Code on GitHub
Compatibility: According to the README, QM works in Slack and on the web. The README says Pi, OpenCode, Codex and Claude Code can drive its core. The README's init command names Fly and AWS as targets, and the README links guides for running on Porter and using Superserve for agent sandboxes. The README says the core runs TypeScript on Node with Fastify, the Slack plugin uses Bolt, and the web UI uses Vite and Lit. The README says memory can be routed to external providers and links a model gateway guide for discovering and routing models.
External costs: According to the README, you run QM in your own cloud account with your own models and keys. The init command names Fly and AWS as targets. The README says Pi, OpenCode, Codex and Claude Code can drive the core, and it mentions a third-party hosted version of QM. It gives no prices. The cloud provider and model provider you use may charge for usage.
Permissions: The README shows npm-based initialization and dependency installation, followed by deployment into the operator's cloud account using model and connector credentials. The README says execute runs commands in the scope's own sandbox and describes scheduled inbox work, watches, webhooks, internal-app publication, pull requests and channel updates. The README says the agent acts with user credentials and permissions and shows sandbox access to logged-in services. The README says Strict pauses tool calls for human approval except two no-effect turn enders; Auto is default and blocks private-network access; Dangerous has no tool approval gates and content screening observes. The README says command-policy approval rules and hard denials for recursive deletes or destructive SQL apply across postures. The top-level file list includes scripts/, but the README does not describe that folder's role. The README's setup asks a coding agent to fetch the repository and follow its deployment guide.
Usage terms: MIT License, as stated in the repository. See its LICENSE file for the exact terms. The README adds that QM is available under the MIT License except where otherwise noted.
Interface: web

Code on GitHub

yc-software/qm

MIT

TypeScript15,398 stars1,907 forksLast pushed 13 Oct 2026 UTC

Multiplayer agent harness for work.

Topics: ai assistant harness qm

Public GitHub data fetched 13 Oct 2026 UTC · 0 days old

Skill folders in this repository (34)

Folders that contain a SKILL.md file, from GitHub's file list on 13 Oct 2026 UTC.

View on GitHub ↗

What it does

The README describes QM as a multiplayer agent harness for work in Slack and on the web, designed for startups. The README says each person and room has scoped memory, files, permissions, scheduled jobs, web apps and a durable sandbox.

The README says Pi, OpenCode, Codex and Claude Code can drive its core. The README describes administrator control over available harnesses, models and security and sharing postures. The README describes scope-owned skills shared by grant, imported skill packs, web apps, crons, watches and inbound webhooks.

The README says deployments run in the operator's cloud account and describes PostgreSQL persistence, per-scope sandboxes and a qm deployment CLI.

Who it is for

Startups and small teams that want one agent harness for work, used by employees in Slack and on the web and deployed in their own cloud account.

Example tasks

The README lists searching internal notes, email, documents, databases and the web together.
The README lists building internal apps and publishing them to the right people.
The README lists learning your writing voice from past sends and triaging your inbox on a schedule.
The README lists working in an existing repository to run tests, open PRs, monitor CI and check system logs.
The README lists tracking a project in a shared channel and posting updates and follow-ups.

Getting started

The README says to tell your coding agent of choice to deploy the repository, and that the agent should follow the deployment guide in it. It also describes creating an organization-owned deployment repository: run the qm init command through npm exec with your organization slug and a Fly or AWS target, then run npm install. Initialization creates a deployment skill for an agent and walks through infrastructure, web sign-in, connector credentials, optional Slack access and deployment. For a source checkout, the README says to install dependencies with npm ci and use the in-tree CLI. The README says to build and deploy modified services with --build-from .; without that option, the deployment uses published images and source edits do not change the deployed runtime. The README also says service builds do not replace the provider's sandbox-image build step. The README has the exact commands. The README says update-qm merges upstream changes into a source fork while preserving intentional local behavior.

Limitations

According to the README, each deployment runs in the operator's own cloud account, and the init command takes a Fly or AWS target. The README's badge lists Node 24.15 or later. For durable sessions you set DATABASE_URL and SESSION_STORE=postgres; without them, sessions live in process memory and vanish on restart. The README says initialization does not generate or enable deployment CI and that the repository has no production deployment workflow. It says content screening is off by default and that the default security posture is Auto. It says Slack is an optional plugin. The repository can change at any time; check its README before you install.

Data practices

According to the README, a Postgres persistence layer holds user data, session history and other durable state, and each deployment runs in the operator's own cloud account. Without DATABASE_URL and SESSION_STORE=postgres, sessions live in process memory. The README says admins choose which harnesses and models are available, and that you run QM with your own models and keys. The README describes optional content screening (securityScreen.mode set to off, observe or enforce) that classifies external content with a built-in model or an external proxy, and says memory can be routed by scope to external providers. The README does not mention telemetry. The README says sharing is Isolated by default, with resources staying in their scope unless explicitly shared; Open permits the speaker's opted-in personal files, artifacts, skills and memory to be read in an opted-in shared room during a live authenticated internal human turn.

QM