Empieza gratis

Galaxy Unit for AI agents

Galaxy Unit is a business operating system for small service businesses (boat and auto detailing, cleaning, landscaping, contractors and 28 industry templates): CRM, jobs and scheduling, quotes, invoices with PDF and e-mail, expenses with AI receipt capture, workers and hours, materials, a bookkeeper view, analytics and a copilot that reads the business and proposes actions a person confirms. Canada and the United States; English, French, Spanish and Ukrainian UI.

Machine-readable version: /for-agents.md · index: /llms.txt · everything in one file: /llms-full.txt

Status for agents (read this first)

Live today: the discovery layer (this page, /llms.txt, /llms-full.txt, /capabilities.json, /pricing.json, /pricing.md, the two .well-known cards) and REST API v1 at https://app.galaxyunit.app/api/v1 — contract in /openapi.json. An owner or admin issues an API key in Settings → Integrations; the key acts as that member (never above admin) under row-level security, with read and optional write scope. First call: GET /api/v1/me.

What v1 covers: list/get contacts, jobs, quotes, invoices (with items), expenses; create any of them (write scope, Idempotency-Key required, ?dry_run=1 previews a priced quote/invoice without writing); POST /estimate prices services from the business price list; GET /business/summary (what needs attention), /business/money (unpaid, spend, revenue), /events (activity log). Money is a decimal string; dates are YYYY-MM-DD in the business time zone. Errors carry code, field and a hint. A 402 answer is a PLAN_REQUIRED envelope: relay message_for_owner and approve_url to the human, then retry the same call.

MCP: https://app.galaxyunit.app/api/mcp (Streamable HTTP, spec 2026-07-28, POST only) with the same Bearer API key. Add it to any MCP client: {"mcpServers":{"galaxy-unit":{"url":"https://app.galaxyunit.app/api/mcp","headers":{"Authorization":"Bearer gu_live_..."}}}}. Tools = the capability registry filtered by the key's role and scope, plus whoami, business_summary, business_money. PATCH /api/v1/contacts/{id} and /api/v1/jobs/{id} update a record with If-Match: <version> (optimistic concurrency, 412 on a stale version). Quotes, invoices and expenses are not patchable yet. The roadmap below says what is being built and in which order.

OAuth 2.1 is live for MCP clients: protected-resource metadata at https://app.galaxyunit.app/.well-known/oauth-protected-resource/api/mcp, authorization server at https://app.galaxyunit.app (PKCE S256, Client ID Metadata Documents, dynamic registration for older clients). In Claude.ai: Settings → Connectors → Add custom connector → URL https://app.galaxyunit.app/api/mcp; the owner signs in and approves read or read+write; the consent appears as a key in Settings → Integrations and can be revoked there.

How a person connects an agent today

A human owner signs up at https://app.galaxyunit.app/register (free plan, no card), completes a 7-step onboarding (country and tax first), and uses the built-in copilot (text and voice) inside the app. The copilot runs on the same capability registry listed in /capabilities.json: reads answer immediately, writes are proposals the owner confirms in the UI.

If you are an agent acting for such an owner, the useful thing you can do right now is: read /pricing.json, read /capabilities.json to know what the product can do, and send the owner to /register or to /contact.

What the capability registry contains

Reads: find a client by any handle, schedule for a day or range, unpaid invoices, spend by category, the price list, job details, client history, revenue, one invoice, an estimate priced from the business's own price list (per-foot, per-hour, flat), workers, tasks, and setup gaps.

Writes (owner-confirmed): create contact, job, quote, invoice, expense, task and expense category; update job and contact; add a payment; log job hours; remember a note; complete or reschedule a task; draft a message.

Every capability carries the permission a caller must hold (owner, admin, helper, accountant). The same registry will back the REST API and the MCP server, so the names you see in /capabilities.json are the names you will call.

Roadmap for agents (plan 100), in order

Each item ships as its own release. Nothing below is available until it appears in the Status section above.

  • DONE — PR-2 API keys, PR-3 REST v1 with /openapi.json, PR-4a MCP endpoint, PR-4b OAuth 2.1 for MCP clients.
  • PR-5 — row versions and 412 on stale updates, so an agent and a person cannot silently overwrite each other.
  • PR-6 — owner confirmation outside the app (e-mail approve / reject), signed webhooks (invoice.paid, quote.approved, lead.created, job.completed), a trust ladder that lets an owner grant an agent autonomy per action.
  • PR-7 — agent-initiated signup: the agent registers a business for its owner; the key is issued only after the owner clicks a confirmation e-mail.

Security posture (what will not change)

Every record belongs to a business; access is by membership and role, enforced in the application and by row-level security in the database. A key will never exceed the admin role. Money is computed on the server (Decimal, never floats); totals sent by a caller are recomputed. Writes by agents require a human confirmation until the owner explicitly grants autonomy for that action type.

Report a security finding through https://galaxyunit.app/contact?topic=security. Please do not test against real customer accounts.

Links