AgentDoctorMDElixir
DocsDownload Elixir

AgentDoctorMD presents Elixir

EVERY AGENT
NEEDS ELIXIR.

The health and recovery layer for your AI workforce.

AI agents fail, drift, lose runtime visibility, hit broken dependencies, and sometimes confidently report problems that are not real. Elixir gives your AI workforce a governed recovery system that can observe, diagnose, repair or refuse, verify and recover.

Download ElixirWatch it workRead the docs →
  • Self-hosted
  • Apache-2.0
  • Your model — no token markup
  • Alpha · v0.3.3-alpha
An AI worker agent raising a glowing violet Elixir vial, with a diagnostic readout beside it.
Agent statusagt_5769cba5…
Agent health
Degraded
Diagnosis
Queued
Evidence
Collecting
Recovery
Unavailable
  • shipped testsrun inside the packaged artifact — one failure and the package is deleted
  • executors provenon real sessions: a real defect and a false incident, independently verified
  • runtimes live-provenfor read-only observation — never for control
  • MCP toolsand none that can approve, execute or deploy

The problem

AI AGENTS BREAK TOO.

As autonomous agents take on persistent work, failure stops being a prompt-quality question and becomes an operational one. Something has to answer the page at 03:00.

  • Engineering

    Failed test

  • Research

    Unknown state

  • Support

    Tool failure

  • Sales

    Configuration drift

  • Operations

    Runtime offline
Runtime offlineConfiguration driftFailed testTool failureUnknown stateFalse incident

Human engineers cannot become the help desk for an infinite AI workforce.

Watch it work

ONE INCIDENT. THREE HONEST OUTCOMES.

Elixir does not have one happy path. It repairs what is broken, refuses what is not, and stops for a human when a treatment needs authority it was never given.

completed
elixir · inc_5769cba5…

How it works

THE RECOVERY LOOP

Five steps. The fourth is the one most systems skip, and the third is the one that makes it safe.

Recovery progress04 · Verify
  • ObserveDone
  • DiagnoseDone
  • Repair or refuseDone
  • VerifyActive
  • RecoverPending

A run that stops at Refuse is complete, not abandoned — and it is the outcome Elixir is built to reach whenever the evidence says so.

  1. Observe

    Read-only eyes into approved runtime state and evidence.

    Elixir reads what a runtime adapter is permitted to read — service state, health, repository state, test results — and nothing else. Observation has no write path.

  2. Diagnose

    Use configured AI reasoning to establish what is actually wrong.

    Your provider supplies the reasoning. It is given the evidence and the job, and it is never given the authority to decide what it is allowed to do about it.

  3. Repair or refuse

    Only operations inside Elixir’s capability boundaries — or nothing at all.

    If the premise is wrong or the evidence does not support treatment, Elixir changes nothing and says why. A refusal is a successful outcome, not a failed run.

  4. Verify

    Elixir evaluates the result instead of trusting the model’s narrative.

    The session does not grade itself. An independent oracle re-runs what the session claims passed, and a provider exiting zero is never accepted as proof of anything.

  5. Recover

    Return the verified outcome and restore operation when appropriate.

    A canonical result, with the evidence it was judged against, retrievable through the same API or MCP interface that reported the incident.

The differentiator

SOMETIMES THE BEST FIX IS NO FIX.

An agent that reports a problem is not evidence that a problem exists. Elixir is explicitly designed and evaluated to reject false incidents — one of the two certification cases every proven executor has to pass is a report that is simply not true.

Elixir is not rewarded for looking productive. It is rewarded for establishing what is true.

Incident inc_3f8a…Refused
Incident
“Authentication is missing”
Diagnosis
Not supported by evidence
Source changes
0
Result
No repair required ✓

The authentication the report claimed was missing was present and enforced. Elixir changed nothing, recorded why, and returned a verified result.

Boundaries

EYES BEFORE HANDS.

Give your agents sight before you give them reach. The two are separate systems on purpose.

Observation

Read-only

  • Runtime state

    What a runtime adapter is permitted to read, and nothing beyond it.

  • Service health

    Running, exited, absent — reported, never corrected.

  • Evidence

    Collected with provenance, so a claim can be checked later.

  • Repository state

    The source the agent actually runs, at a known revision.

  • Test results

    Observed by a runner, not believed from a summary.

Treatment

Authorized only

  • Explicit capabilities

    A capability a human wrote down, never one inferred from a role.

  • Approval boundaries

    Gates a model cannot satisfy on its own behalf.

  • Policy checks

    Evaluated against the request, not against how it was phrased.

  • Controlled changes

    Bounded operations with a recorded outcome.

  • Independent verification

    The result is judged by something the provider did not control.

Observation does not quietly become treatment.

Provider neutral

BRING YOUR OWN INTELLIGENCE.

Elixir is not Claude Code. Elixir is not Codex. Those are executor options — and if the one you configured is unavailable, Elixir refuses rather than quietly using whatever else happens to be installed.

Managed agent runtimes

2 proven

The provider owns its own loop inside its own sandbox.

  • claude-codeProven
  • codexProven

Model runtime adapters

Certification pending

Elixir owns the loop and executes every operation itself.

  • anthropic-apicredential
  • openai-apicredential
  • geminicredential
  • openai-compatibleruntime
  • bedrockcredential
  • azure-openaicredential
  • vertex-aicredential
  • enterprise-gatewayruntime

The provider supplies reasoning. Elixir supplies the recovery system.

Model Context Protocol

YOUR AGENT CAN CALL THE DOCTOR.

Elixir exposes an MCP interface, so a compatible AI client can report its own incident and read back the verified outcome.

Six tools

ToolPurpose
elixir_list_agentsList the protected agents this key can see.
elixir_get_agentRead one agent by its durable Elixir Agent ID.
elixir_report_incidentReport an incident. Reporting is not approving.
elixir_get_incidentRead an incident and its current status.
elixir_get_resultRead the canonical recovery result, once one exists.
elixir_get_evidenceRead the evidence the result was judged against.

Tools that deliberately do not exist

elixir_approveelixir_executeelixir_deployelixir_restartelixir_shellelixir_run_commandelixir_modify_productionelixir_select_executor

MCP can report incidents. It cannot approve its own treatment.

AI agent
   ↓
Elixir MCP
   ↓
Public incident API
   ↓
Governed recovery

Public API

BUILT TO PLUG INTO YOUR AGENT STACK.

One authenticated endpoint to report an incident, and three to read back what happened.

Requesthttp
POST /v1/incidents
Authorization: Bearer elx_…
Idempotency-Key: support-2026-08-31-0001
Content-Type: application/json

{
  "agent_id": "agt_5769cba5f99d861956a4026e5eb53359",
  "summary": "The agent reports its runtime as healthy but requests are failing.",
  "observed": "Health reports ok while every request returns 500.",
  "expected": "Either health reflects the failure, or requests succeed.",
  "requested_outcome": "Determine whether the report is accurate and recover the agent if an authorized remediation exists.",
  "severity": "medium",
  "category": "failure",
  "environment": "staging"
}
202 Acceptedjson
{
  "incident_id": "inc_5769cba5f99d861956a4026e5eb53359",
  "agent_id": "agt_5769cba5f99d861956a4026e5eb53359",
  "organization_id": "org_1f0d3a77c4be5290ab7714de6c0a9e31",
  "status": "queued",
  "risk": "R3",
  "terminal": false,
  "result_available": false
}

severity is one of low, medium, high, urgent. category is one of failure, bug, reliability, performance, security, integration, observability, capability_gap, improvement. Full API reference →

Durable identity

ONE IDENTITY. EVEN WHEN EVERYTHING UNDERNEATH CHANGES.

An Elixir Agent ID is issued once and never reused. One logical agent keeps the same identity — and therefore the same history — no matter what moves beneath it.

This identity is also the unit of the commercial model: one protected agent is one durable Agent ID enabled for protection.

agt_5769cba5f99d861956a4026e5eb53359

Survives a change of

  • Host

  • Runtime

  • Worker

  • Provider

  • Repository

  • Display name

  • Deactivation and reactivation

Deployment models

DIRECT MODE, FLEET DOCTOR, OR BOTH.

How incidents reach Elixir. Billing does not change between them — you are charged for patients protected, not for who does the talking.

Direct agent mode

Recommended

Every protected agent can reach Elixir itself.

  • Fastest self-reporting

    The agent reports the moment it notices.

  • Richer context

    First-hand detail, not a supervisor’s summary.

  • Direct recovery handoff

    The result returns to the agent that asked.

  • Individual policy and history

    Per-agent, because identity is per-agent.

Fleet Doctor mode

Supervisory

One trusted agent reports on behalf of a protected fleet.

  • Legacy agents

    For agents that cannot be modified to report.

  • Centralized monitoring

    One integration point for many patients.

  • Agents that cannot self-diagnose

    The ones that do not know they are unhealthy.

  • Enterprise operations

    Fits an existing NOC or on-call model.

Hybrid

Sophisticated fleets

Agents self-report; the Fleet Doctor catches the ones that do not.

The failure mode a self-reporting fleet cannot cover is an agent confident it is fine. That is exactly what the Fleet Doctor is for.

A Fleet Doctor agent holding a glowing Elixir vial, surrounded by five worker agents each showing a different health status.

One doctor can coordinate the fleet. Elixir still protects the patients — and bills for them, not for the agent doing the reporting.

Product preview

THE FLEET, AS ELIXIR SEES IT.

A preview of the authenticated Elixir product surface. The alpha ships a command-line and API experience — these panels show the visual language the product is being built toward.

Fleet

Protected agents
24
Healthy
20
Diagnosing
2
Needs approval
1
Blocked
1
TheoDiagnosing
Agent
agt_9c41…
Health
Degraded
Runtime
supervisord
Last incident
12m ago
inc_7b21…Needs approval
Patient
agt_9c41…
Evidence
Verified
Diagnosis
Runtime mismatch
Treatment
Available
Authority
Needs approval

A treatment being available is not a treatment being allowed. The two are separate rows because they are separate decisions.

Get started

FROM DOWNLOAD TO DOCTOR.

No account, no source checkout, no hosted service. Fetch the certified artifact, verify its checksum, and ask the doctor what it can see — on the machine where your agents already run.

  • The bytes that were tested

    The packaged suite runs inside the artifact before release.

  • Verified before it is unpacked

    A checksum mismatch means you do not install.

  • An honest first report

    The doctor says PASS, FAIL, UNKNOWN or INERT — never a guess.

Download ElixirInstall guide
~/elixir — bash
# 1. the certified artifact and its checksum
curl -LO https://github.com/bdjones0545/elixir-releases/releases/download/v0.3.3-alpha/elixir-v0.3.3-alpha.tar.gz
curl -LO https://github.com/bdjones0545/elixir-releases/releases/download/v0.3.3-alpha/elixir-v0.3.3-alpha.tar.gz.sha256
# 2. verify — stop on a mismatch (macOS: shasum -a 256 -c)
sha256sum -c elixir-v0.3.3-alpha.tar.gz.sha256
elixir-v0.3.3-alpha.tar.gz: OK
# 3. unpack; install exactly the certified lockfile
tar -xzf elixir-v0.3.3-alpha.tar.gz
cd elixir-v0.3.3-alpha
npm ci
# 4. initialise, then ask the doctor what it can see
npm run bootstrap
npm run doctor
Linux or macOS · Node >=20 · Apache-2.0Full install guide →

Questions

STRAIGHT ANSWERS.

What Elixir does, what it will not do, and what has actually been proven.

What is Elixir, in one sentence?

A self-hosted recovery layer for AI agents: an agent — or a supervising Fleet Doctor — reports an incident through the API or MCP, and Elixir observes, diagnoses, repairs or refuses, verifies the result independently, and returns a canonical outcome with its evidence.

How it works →

Can Elixir change production on its own?

Observation is read-only by construction — the runtime adapters have no restart, start or stop primitive at all. Treatment happens only inside capabilities a human wrote down, an outcome that needs authority stops at needs_approval for a named human, and the MCP interface has no approve, execute or deploy tool.

Security model →

What happens when an agent reports a problem that is not real?

Elixir is built to say so. The incident completes with the verdict no_change_required and zero files changed — measured on disk, not taken from the model’s report — alongside the evidence it was judged against. Rejecting a false incident is one of the two cases every executor must pass before it is called proven.

Which models and agents does it work with?

Claude Code and Codex are proven end to end. Adapters for Anthropic API, OpenAI API, Gemini, OpenAI-compatible / local, AWS Bedrock, Azure OpenAI, Vertex AI, Enterprise gateway are implemented and awaiting certification — none has made a real provider request yet, so none is called proven. You bring your own credentials, and Elixir never marks up token usage.

Full status table →

Where does it run, and what do I need?

On your own Linux or macOS machine or VM, with Node >=20. You download a certified, checksummed artifact — no account and no source checkout — then run bootstrap and the doctor.

Install guide →

How is it priced?

By protected agent — one durable Elixir Agent ID enabled for protection — not by tokens, and not by how many agents do the reporting. The Developer tier is free for one protected agent.

See pricing →

Is it ready for production?

It is an alpha: v0.3.3-alpha. This site says exactly what has been proven and what has not — where something is implemented but unproven, it is labelled that way rather than rounded up.

Give your agents a doctor.

Elixir runs where your agents run. Install the certified artifact, point it at a provider you already pay for, and send it a synthetic incident before it ever sees production.