DEV Community: Di3Z1E

SpindleX: A Modern, Secure-by-Default SSH Library for Python

Di3Z1E — Fri, 18 Sep 2026 10:11:01 +0000

Paramiko has quietly run the Python SSH ecosystem for fifteen years.

It's a remarkable piece of software, and also a product of its era: agent forwarding, X11, GSSAPI key exchange, ciphers nobody should still be negotiating in 2026.

All of it still there, all of it still supported, because that's what backward compatibility demands.

SpindleX starts from a different premise.
Support less. Say no to more. What's left, harden completely.

pip install spindlex

v1.0 just shipped: the public API is frozen under SemVer, and it's live on PyPI.

The scope is the feature

SpindleX doesn't do SCP, agent forwarding, X11, or compression.
That's not a roadmap gap, it's a decision.
Every one of those is a historical source of SSH CVEs, and none of them are load-bearing for the thing most people actually use SSH for: running commands and moving files.

What's left gets treated seriously:

ChaCha20-Poly1305 as the preferred cipher (AEAD, no bolted-on MAC pass)
Strict-KEX enabled unconditionally, closing the Terrapin downgrade class of attacks
No SHA-1, no CBC, no DH Group 1: not deprecated, just absent
Host key verification on by default: you opt out, not in
One runtime dependency: cryptography

If your workflow needs the things SpindleX left out, it's not ready to be your library. If it doesn't, the smaller surface is the whole point.

What it looks like

from spindlex import SSHClient

with SSHClient() as client:
    client.get_host_keys().load()
    client.connect("example.com", username="admin")
    stdin, stdout, stderr = client.exec_command("uptime")
    print(stdout.read().decode().strip())

Async isn't an add-on module. It's the same client shape, awaited:

import asyncio
from spindlex import AsyncSSHClient

async def main():
    async with AsyncSSHClient() as client:
        client.get_host_keys().load()
        await client.connect("example.com", username="admin")
        stdin, stdout, stderr = await client.exec_command("df -h")
        print(await stdout.read())

asyncio.run(main())

Nothing in either example configures a cipher, opts into strict-KEX, or remembers to verify a host key. There's nothing to remember: it's already the default.

And it holds up on throughput

SpindleX negotiates adaptive SFTP write chunks up to 255 KB via limits@openssh.com.
On loopback benchmarks against a Dockerized OpenSSH server, that puts transfer throughput ahead of Paramiko and roughly even with AsyncSSH, with handshake latency in the same range as both.

Numbers and methodology are in the comparison doc. Loopback isn't the real world, but it's a fair starting signal.

Where it stands today

v1.0.0 means the API won't move under you, not that this has fifteen years of production scar tissue behind it.

If SCP or agent forwarding are load-bearing for you, or you're already deep in a Paramiko codebase, there's no reason to switch yet.

If you're starting something new, particularly something async, particularly something where the SSH surface should stay small, it's worth the look.

pip install spindlex

MIT licensed.
Issues and PRs are welcome: it's a small enough codebase that reading it is a reasonable way to evaluate it.

[Boost]

Di3Z1E — Sat, 16 May 2026 18:12:44 +0000

Di3Z1E

May 16

SpindleX: A Modern Pure-Python SSHv2 and SFTP Library

#ssh #devops #python #automation

2 min read

SpindleX: A Modern Pure-Python SSHv2 and SFTP Library

Di3Z1E — Sat, 16 May 2026 09:15:02 +0000

SpindleX: A Modern Pure-Python SSHv2 and SFTP Library

After years of working with existing SSH libraries in Python, I decided to build a new one from the ground up with modern needs in mind.

Today I'm excited to introduce SpindleX (spindlex) - a clean, high-performance, secure-by-default SSHv2 and SFTP client/server library for Python 3.9+.

Why Another SSH Library?

Paramiko has been the go-to for a very long time, but it carries a lot of legacy code and older defaults. asyncssh is excellent for async use cases, but I wanted something that combines excellent developer experience, strong security defaults, great performance, first-class asyncio support, and a fresh, maintainable codebase.

Why SpindleX?

Business Friendly: MIT Licensed. Permissive use for commercial and proprietary projects.
Maintainable Code: Modular architecture designed for clarity and easier security auditing.
Modern API: Clean, intuitive interface with consistent error handling and minimal dependencies.
Focused Scope: No support for insecure legacy protocols, resulting in a leaner and more secure codebase.

Key Features

Secure by default: Only modern algorithms (ChaCha20-Poly1305 preferred, Ed25519, ECDSA, AES-CTR, etc.), Legacy ciphers are excluded, Full protection against Terrapin attacks and strict host key verification.
High Performance SFTP: Adaptive chunk sizes (up to 255 KB), excellent pipelining, and optimized buffering.
Native Async Support: Clean AsyncSSHClient and AsyncSFTPClient alongside the synchronous version.
Usability: Recursive directory upload/download, ProxyJump / bastion host support, local/remote port forwarding, and a fully
typed API.
Minimal Dependencies: Mainly relies on cryptography. MIT licensed.
Both client and server implementations.

Quick Example

from spindlex import SSHClient
from spindlex.hostkeys.policy import RejectPolicy

with SSHClient() as client:
    # Secure default: reject unknown host keys. Make sure the server's key
    # is in ~/.ssh/known_hosts before running (e.g. via `ssh user@host` once).
    client.set_missing_host_key_policy(RejectPolicy())
    client.get_host_keys().load()

    client.connect('server.example.com', username='admin', password='password')

    # exec_command returns (stdin, stdout, stderr)
    stdin, stdout, stderr = client.exec_command('ls -l /tmp')

    # stdout and stderr are iterable and return lines
    for line in stdout:
        print(line.strip())

    # Get the exit status (0 usually means success)
    exit_status = stdout.recv_exit_status()
    print(f"Command exited with status: {exit_status}")

Current Status

Latest version: v0.7.0 (released today)
Still in Beta, early stage with limited real-world usage
Actively developed with frequent releases

Try It & Give Feedback

If you're working on automation, DevOps tools, remote management, or any project that needs SSH/SFTP, I'd love for you to try SpindleX, especially on new projects.

Feedback, bug reports, feature requests, and contributions are all very welcome!

What do you think? Are you happy with Paramiko/asyncssh, or would you consider switching to something newer?

Let me know in the comments!

DEV Community: Di3Z1E

SpindleX: A Modern, Secure-by-Default SSH Library for Python

The scope is the feature

What it looks like

And it holds up on throughput

Where it stands today

[Boost]

SpindleX: A Modern Pure-Python SSHv2 and SFTP Library

SpindleX: A Modern Pure-Python SSHv2 and SFTP Library

SpindleX: A Modern Pure-Python SSHv2 and SFTP Library

Why Another SSH Library?

Why SpindleX?

Key Features

Quick Example

Current Status

Links

Try It & Give Feedback