Project Mimir Review 2026: Self-Hosted Endpoint Security

Project Mimir is endpoint visibility software for security teams. Built on osquery, it enrolls company devices so administrators can inspect host inventory, run SQL queries across a fleet, find indicators of compromise, and send alerts to a SIEM.

The platform is designed to run on infrastructure controlled by the operator. Mimir says endpoint data stays within that boundary and that its server does not need outbound internet access. It describes support for Windows, macOS, several Linux distributions, and FreeBSD, with some platforms marked as community-supported rather than CI-tested.

The homepage describes Mimir as free and lists Apache 2.0 / BSL 1.1 licensing. It does not publish details about paid support, independent security audits, or the team behind the project.

Project Mimir combines osquery with a self-hosted server and agent. After an administrator enrolls a host, the agent communicates with the server using gRPC over mutually authenticated TLS. Mimir says each host receives its own client certificate, and enrollment secrets are single-use. Host heartbeats and system facts feed the inventory, while administrators can run SQL queries across enrolled devices.

For threat hunting, teams can add indicators manually, import them in bulk, or subscribe to feeds. Mimir says it checks incoming process, file, and network events for matches and searches the previous 30 days of fleet history when a new indicator is added. Alerts can be reviewed in a shared feed and forwarded to a SIEM or other HTTPS endpoint. Because the platform is self-hosted, the operator is responsible for server availability, database and key management, access control, and agent rollout.

Project Mimir describes itself as free. It does not publish details about paid tiers, support pricing, or other possible charges. The site lists Apache 2.0 / BSL 1.1 licensing; check the project documentation and applicable license terms for the components you plan to use.

Mimir describes several security measures, including mutual TLS, one-time enrollment secrets, signed agent releases, encrypted data at rest using the operator's KMS, and an append-only signed audit log. These are project claims; the homepage does not publish independent audit details or a security incident history. The project is open source, which allows inspection, but that alone does not establish that the software has been independently reviewed.

Self-hosting gives the operator control over data residency, but also makes the operator responsible for server security, database protection, access controls, backups, and agent updates. The homepage does not state a regulatory certification or license.

Project Mimir is best suited to security teams with the infrastructure and staff to run endpoint tooling themselves, especially organizations that require control over where host data is stored. Teams seeking a managed service, independently documented audit assurance, or minimal operational overhead may want to compare alternatives.