Y Combinator's QM: A Multi-User Cloud Agent Harness

Architecture and Deployment

QM is a full-stack web application designed for self-hosting on organizational infrastructure. Unlike local agent harnesses that run on a developer's machine, QM utilizes a headless backend to manage agent loops and a PostgreSQL database to persist session history. Each user or project is assigned an isolated container with dedicated storage, ensuring that environment setups, cloned repositories, and installed dependencies persist across sessions.

Collaborative Context and Security

QM enables shared workspaces where team members can access common memory, files, and connectors. The platform implements a hierarchical security model with three organizational-wide settings:

• Strict: Requires human approval for nearly all tool calls.
• Auto: Employs a classifier to screen external data and tool results before they reach the model.
• Dangerous: Removes screening and pauses.

Administrators can enforce command policies that block destructive operations, such as recursive deletes or harmful SQL queries, regardless of the selected mode. Teams can further restrict these settings for specific projects, though they cannot override the organizational-level security ceiling.

Agent Capabilities and Tooling

QM simplifies agent interaction by minimizing the tool surface to seven core primitives: execute, read, write, publish, memory, history, and background. Rather than relying on a complex array of Model Context Protocol (MCP) servers, the agent operates via shell commands within its sandbox. Users can configure different harnesses, such as Claude Code, to run within the QM environment. Adding new harnesses currently requires an API call to the /harnesses endpoint, as the admin UI lacks native controls for this configuration.