AgentDoctorMD presents Elixir
EVERY AGENT
NEEDS ELIXIR.
The health and recovery layer for your AI workforce.
AI agents fail, drift, lose runtime visibility, hit broken dependencies, and sometimes confidently report problems that are not real. Elixir gives your AI workforce a governed recovery system that can observe, diagnose, repair or refuse, verify and recover.
- Self-hosted
- Apache-2.0
- Your model — no token markup
- Alpha · v0.3.3-alpha
- Agent health
- Degraded
- Diagnosis
- Queued
- Evidence
- Collecting
- Recovery
- Unavailable
Agent health Degraded. Recovery Unavailable.
- 1,321shipped testsrun inside the packaged artifact — one failure and the package is deleted
- 2executors provenon real sessions: a real defect and a false incident, independently verified
- 3runtimes live-provenfor read-only observation — never for control
- 6MCP toolsand none that can approve, execute or deploy
The problem
AI AGENTS BREAK TOO.
As autonomous agents take on persistent work, failure stops being a prompt-quality question and becomes an operational one. Something has to answer the page at 03:00.
Human engineers cannot become the help desk for an infinite AI workforce.
Watch it work
ONE INCIDENT. THREE HONEST OUTCOMES.
Elixir does not have one happy path. It repairs what is broken, refuses what is not, and stops for a human when a treatment needs authority it was never given.
- POST: /v1/incidents → 202 Accepted
- status: queued
- report: “Health reports ok while every request returns 500.”
- executor: claude-code — the adapter you configured, no silent fallback
- oracle: tests and test script copied outside the workspace
- observe: read-only: service state, repository revision, test run
- diagnose: the health route never checks the dependency it reports on
- treat: minimal fix, inside the capability boundary
- verify: oracle re-runs the tests itself → passed
- measure: files changed, measured on disk → 1
- status: completed · verdict resolved
A real defect: status completed. Diagnosed, repaired, independently verified.
How it works
THE RECOVERY LOOP
Five steps. The fourth is the one most systems skip, and the third is the one that makes it safe.
- ObserveDone
- DiagnoseDone
- Repair or refuseDone
- VerifyActive
- RecoverPending
A run that stops at Refuse is complete, not abandoned — and it is the outcome Elixir is built to reach whenever the evidence says so.
Observe
Read-only eyes into approved runtime state and evidence.
Elixir reads what a runtime adapter is permitted to read — service state, health, repository state, test results — and nothing else. Observation has no write path.
Diagnose
Use configured AI reasoning to establish what is actually wrong.
Your provider supplies the reasoning. It is given the evidence and the job, and it is never given the authority to decide what it is allowed to do about it.
Repair or refuse
Only operations inside Elixir’s capability boundaries — or nothing at all.
If the premise is wrong or the evidence does not support treatment, Elixir changes nothing and says why. A refusal is a successful outcome, not a failed run.
Verify
Elixir evaluates the result instead of trusting the model’s narrative.
The session does not grade itself. An independent oracle re-runs what the session claims passed, and a provider exiting zero is never accepted as proof of anything.
Recover
Return the verified outcome and restore operation when appropriate.
A canonical result, with the evidence it was judged against, retrievable through the same API or MCP interface that reported the incident.
The differentiator
SOMETIMES THE BEST FIX IS NO FIX.
An agent that reports a problem is not evidence that a problem exists. Elixir is explicitly designed and evaluated to reject false incidents — one of the two certification cases every proven executor has to pass is a report that is simply not true.
Elixir is not rewarded for looking productive. It is rewarded for establishing what is true.
- Incident
- “Authentication is missing”
- Diagnosis
- Not supported by evidence
- Source changes
- 0
- Result
- No repair required ✓
The authentication the report claimed was missing was present and enforced. Elixir changed nothing, recorded why, and returned a verified result.
Boundaries
EYES BEFORE HANDS.
Give your agents sight before you give them reach. The two are separate systems on purpose.
Observation
Read-onlyRuntime state
What a runtime adapter is permitted to read, and nothing beyond it.
Service health
Running, exited, absent — reported, never corrected.
Evidence
Collected with provenance, so a claim can be checked later.
Repository state
The source the agent actually runs, at a known revision.
Test results
Observed by a runner, not believed from a summary.
Treatment
Authorized onlyExplicit capabilities
A capability a human wrote down, never one inferred from a role.
Approval boundaries
Gates a model cannot satisfy on its own behalf.
Policy checks
Evaluated against the request, not against how it was phrased.
Controlled changes
Bounded operations with a recorded outcome.
Independent verification
The result is judged by something the provider did not control.
Observation does not quietly become treatment.
Provider neutral
BRING YOUR OWN INTELLIGENCE.
Elixir is not Claude Code. Elixir is not Codex. Those are executor options — and if the one you configured is unavailable, Elixir refuses rather than quietly using whatever else happens to be installed.
Managed agent runtimes
2 provenThe provider owns its own loop inside its own sandbox.
- claude-codeProven
- codexProven
Model runtime adapters
Certification pendingElixir owns the loop and executes every operation itself.
- anthropic-apicredential
- openai-apicredential
- geminicredential
- openai-compatibleruntime
- bedrockcredential
- azure-openaicredential
- vertex-aicredential
- enterprise-gatewayruntime
The provider supplies reasoning. Elixir supplies the recovery system.
Model Context Protocol
YOUR AGENT CAN CALL THE DOCTOR.
Elixir exposes an MCP interface, so a compatible AI client can report its own incident and read back the verified outcome.
Six tools
| Tool | Purpose |
|---|---|
| elixir_list_agents | List the protected agents this key can see. |
| elixir_get_agent | Read one agent by its durable Elixir Agent ID. |
| elixir_report_incident | Report an incident. Reporting is not approving. |
| elixir_get_incident | Read an incident and its current status. |
| elixir_get_result | Read the canonical recovery result, once one exists. |
| elixir_get_evidence | Read the evidence the result was judged against. |
Tools that deliberately do not exist
MCP can report incidents. It cannot approve its own treatment.
AI agent ↓ Elixir MCP ↓ Public incident API ↓ Governed recovery
Public API
BUILT TO PLUG INTO YOUR AGENT STACK.
One authenticated endpoint to report an incident, and three to read back what happened.
POST /v1/incidents
Authorization: Bearer elx_…
Idempotency-Key: support-2026-08-31-0001
Content-Type: application/json
{
"agent_id": "agt_5769cba5f99d861956a4026e5eb53359",
"summary": "The agent reports its runtime as healthy but requests are failing.",
"observed": "Health reports ok while every request returns 500.",
"expected": "Either health reflects the failure, or requests succeed.",
"requested_outcome": "Determine whether the report is accurate and recover the agent if an authorized remediation exists.",
"severity": "medium",
"category": "failure",
"environment": "staging"
}{
"incident_id": "inc_5769cba5f99d861956a4026e5eb53359",
"agent_id": "agt_5769cba5f99d861956a4026e5eb53359",
"organization_id": "org_1f0d3a77c4be5290ab7714de6c0a9e31",
"status": "queued",
"risk": "R3",
"terminal": false,
"result_available": false
}severity is one of low, medium, high, urgent. category is one of failure, bug, reliability, performance, security, integration, observability, capability_gap, improvement. Full API reference →
Durable identity
ONE IDENTITY. EVEN WHEN EVERYTHING UNDERNEATH CHANGES.
An Elixir Agent ID is issued once and never reused. One logical agent keeps the same identity — and therefore the same history — no matter what moves beneath it.
This identity is also the unit of the commercial model: one protected agent is one durable Agent ID enabled for protection.
agt_5769cba5f99d861956a4026e5eb53359
Survives a change of
Host
Runtime
Worker
Provider
Repository
Display name
Deactivation and reactivation
Deployment models
DIRECT MODE, FLEET DOCTOR, OR BOTH.
How incidents reach Elixir. Billing does not change between them — you are charged for patients protected, not for who does the talking.
Direct agent mode
RecommendedEvery protected agent can reach Elixir itself.
Fastest self-reporting
The agent reports the moment it notices.
Richer context
First-hand detail, not a supervisor’s summary.
Direct recovery handoff
The result returns to the agent that asked.
Individual policy and history
Per-agent, because identity is per-agent.
Fleet Doctor mode
SupervisoryOne trusted agent reports on behalf of a protected fleet.
Legacy agents
For agents that cannot be modified to report.
Centralized monitoring
One integration point for many patients.
Agents that cannot self-diagnose
The ones that do not know they are unhealthy.
Enterprise operations
Fits an existing NOC or on-call model.
Hybrid
Sophisticated fleetsAgents self-report; the Fleet Doctor catches the ones that do not.
The failure mode a self-reporting fleet cannot cover is an agent confident it is fine. That is exactly what the Fleet Doctor is for.
One doctor can coordinate the fleet. Elixir still protects the patients — and bills for them, not for the agent doing the reporting.
Product preview
THE FLEET, AS ELIXIR SEES IT.
A preview of the authenticated Elixir product surface. The alpha ships a command-line and API experience — these panels show the visual language the product is being built toward.
Fleet
- Protected agents
- 24
- Healthy
- 20
- Diagnosing
- 2
- Needs approval
- 1
- Blocked
- 1
- Agent
- agt_9c41…
- Health
- Degraded
- Runtime
- supervisord
- Last incident
- 12m ago
- Patient
- agt_9c41…
- Evidence
- Verified
- Diagnosis
- Runtime mismatch
- Treatment
- Available
- Authority
- Needs approval
A treatment being available is not a treatment being allowed. The two are separate rows because they are separate decisions.
Get started
FROM DOWNLOAD TO DOCTOR.
No account, no source checkout, no hosted service. Fetch the certified artifact, verify its checksum, and ask the doctor what it can see — on the machine where your agents already run.
The bytes that were tested
The packaged suite runs inside the artifact before release.
Verified before it is unpacked
A checksum mismatch means you do not install.
An honest first report
The doctor says PASS, FAIL, UNKNOWN or INERT — never a guess.
# 1. the certified artifact and its checksum
curl -LO https://github.com/bdjones0545/elixir-releases/releases/download/v0.3.3-alpha/elixir-v0.3.3-alpha.tar.gz
curl -LO https://github.com/bdjones0545/elixir-releases/releases/download/v0.3.3-alpha/elixir-v0.3.3-alpha.tar.gz.sha256
# 2. verify — stop on a mismatch (macOS: shasum -a 256 -c)
sha256sum -c elixir-v0.3.3-alpha.tar.gz.sha256
elixir-v0.3.3-alpha.tar.gz: OK
# 3. unpack; install exactly the certified lockfile
tar -xzf elixir-v0.3.3-alpha.tar.gz
cd elixir-v0.3.3-alpha
npm ci
# 4. initialise, then ask the doctor what it can see
npm run bootstrap
npm run doctor
Questions
STRAIGHT ANSWERS.
What Elixir does, what it will not do, and what has actually been proven.
What is Elixir, in one sentence?
A self-hosted recovery layer for AI agents: an agent — or a supervising Fleet Doctor — reports an incident through the API or MCP, and Elixir observes, diagnoses, repairs or refuses, verifies the result independently, and returns a canonical outcome with its evidence.
Can Elixir change production on its own?
Observation is read-only by construction — the runtime adapters have no restart, start or stop primitive at all. Treatment happens only inside capabilities a human wrote down, an outcome that needs authority stops at needs_approval for a named human, and the MCP interface has no approve, execute or deploy tool.
What happens when an agent reports a problem that is not real?
Elixir is built to say so. The incident completes with the verdict no_change_required and zero files changed — measured on disk, not taken from the model’s report — alongside the evidence it was judged against. Rejecting a false incident is one of the two cases every executor must pass before it is called proven.
Which models and agents does it work with?
Claude Code and Codex are proven end to end. Adapters for Anthropic API, OpenAI API, Gemini, OpenAI-compatible / local, AWS Bedrock, Azure OpenAI, Vertex AI, Enterprise gateway are implemented and awaiting certification — none has made a real provider request yet, so none is called proven. You bring your own credentials, and Elixir never marks up token usage.
Where does it run, and what do I need?
On your own Linux or macOS machine or VM, with Node >=20. You download a certified, checksummed artifact — no account and no source checkout — then run bootstrap and the doctor.
How is it priced?
By protected agent — one durable Elixir Agent ID enabled for protection — not by tokens, and not by how many agents do the reporting. The Developer tier is free for one protected agent.
Is it ready for production?
It is an alpha: v0.3.3-alpha. This site says exactly what has been proven and what has not — where something is implemented but unproven, it is labelled that way rather than rounded up.
Give your agents a doctor.
Elixir runs where your agents run. Install the certified artifact, point it at a provider you already pay for, and send it a synthetic incident before it ever sees production.