DEV Community

Cover image for SpindleX: A Modern, Secure-by-Default SSH Library for Python
Di3Z1E
Di3Z1E

Posted on

SpindleX: A Modern, Secure-by-Default SSH Library for Python

#python #ssh #security #opensource

Paramiko has quietly run the Python SSH ecosystem for fifteen years.

It's a remarkable piece of software, and also a product of its era: agent forwarding, X11, GSSAPI key exchange, ciphers nobody should still be negotiating in 2026.

All of it still there, all of it still supported, because that's what backward compatibility demands.

SpindleX starts from a different premise.
Support less. Say no to more. What's left, harden completely.

pip install spindlex
Enter fullscreen mode Exit fullscreen mode

v1.0 just shipped: the public API is frozen under SemVer, and it's live on PyPI.

The scope is the feature

SpindleX doesn't do SCP, agent forwarding, X11, or compression.
That's not a roadmap gap, it's a decision.
Every one of those is a historical source of SSH CVEs, and none of them are load-bearing for the thing most people actually use SSH for: running commands and moving files.

What's left gets treated seriously:

  • ChaCha20-Poly1305 as the preferred cipher (AEAD, no bolted-on MAC pass)
  • Strict-KEX enabled unconditionally, closing the Terrapin downgrade class of attacks
  • No SHA-1, no CBC, no DH Group 1: not deprecated, just absent
  • Host key verification on by default: you opt out, not in
  • One runtime dependency: cryptography

If your workflow needs the things SpindleX left out, it's not ready to be your library. If it doesn't, the smaller surface is the whole point.

What it looks like 

from spindlex import SSHClient

with SSHClient() as client:
    client.get_host_keys().load()
    client.connect("example.com", username="admin")
    stdin, stdout, stderr = client.exec_command("uptime")
    print(stdout.read().decode().strip())
Enter fullscreen mode Exit fullscreen mode

Async isn't an add-on module. It's the same client shape, awaited:

import asyncio
from spindlex import AsyncSSHClient

async def main():
    async with AsyncSSHClient() as client:
        client.get_host_keys().load()
        await client.connect("example.com", username="admin")
        stdin, stdout, stderr = await client.exec_command("df -h")
        print(await stdout.read())

asyncio.run(main())
Enter fullscreen mode Exit fullscreen mode

Nothing in either example configures a cipher, opts into strict-KEX, or remembers to verify a host key. There's nothing to remember: it's already the default.

And it holds up on throughput

SpindleX negotiates adaptive SFTP write chunks up to 255 KB via limits@openssh.com.
On loopback benchmarks against a Dockerized OpenSSH server, that puts transfer throughput ahead of Paramiko and roughly even with AsyncSSH, with handshake latency in the same range as both.

Numbers and methodology are in the comparison doc. Loopback isn't the real world, but it's a fair starting signal.

Where it stands today

v1.0.0 means the API won't move under you, not that this has fifteen years of production scar tissue behind it.

If SCP or agent forwarding are load-bearing for you, or you're already deep in a Paramiko codebase, there's no reason to switch yet.

If you're starting something new, particularly something async, particularly something where the SSH surface should stay small, it's worth the look.

pip install spindlex
Enter fullscreen mode Exit fullscreen mode

MIT licensed.
Issues and PRs are welcome: it's a small enough codebase that reading it is a reasonable way to evaluate it.

Top comments (0)