⚡ Overview
SpindleX is a modern SSH protocol implementation for Python 3.9+. It is designed for high-performance automation and secure file transfers, providing a clean alternative to legacy SSH libraries.
🔥 Key Features
- 🚀 High Performance: Adaptive SFTP write chunks up to 255 KB via
limits@openssh.comnegotiation, pipelined transfers, and zero-copy internal buffering. - 🔒 ChaCha20-Poly1305: Preferred AEAD cipher - no separate MAC pass, full Terrapin-defense strict-KEX, on par with leading SSH libraries.
- 🔄 Native Async: First-class
asynciosupport viaAsyncSSHClientandAsyncSFTPClient. - 🛡️ Secure by Default: Modern primitives only - Ed25519, ECDSA, ChaCha20-Poly1305, AES-CTR. Legacy/weak ciphers are not negotiated.
- 🔗 Advanced Tunneling: ProxyJump (bastion hosts) via
direct-tcpipchannels and TCP port forwarding. - 📂 Recursive SFTP: Native support for recursive directory uploads and downloads.
- 🏷️ Fully Typed: Comprehensive type hints for IDE integration and static analysis.
💎 Why SpindleX?
- 💼 Business Friendly: MIT Licensed. Permissive use for commercial and proprietary projects.
- 📖 Maintainable Code: Modular architecture designed for clarity and easier security auditing.
- 🛠️ Modern API: Clean, intuitive interface with consistent error handling and minimal dependencies.
- 🧊 Focused Scope: No support for insecure legacy protocols, resulting in a leaner and more secure codebase.
🛠️ Tech Stack
Core Logic 
Protocol 
Concurrency
🚀 Quick Start
Installation
# Using pip
pip install spindlex
# Using uv
uv pip install spindlex
💻 Usage Preview
Synchronous Example
from spindlex import SSHClient
with SSHClient() as client:
client.get_host_keys().load()
client.connect('example.com', username='admin')
stdin, stdout, stderr = client.exec_command('uptime')
print(f"Server Status: {stdout.read().decode().strip()}")
Asynchronous Example
import asyncio
from spindlex import AsyncSSHClient
async def main():
async with AsyncSSHClient() as client:
client.get_host_keys().load()
await client.connect('example.com', username='admin')
stdin, stdout, stderr = await client.exec_command('df -h')
print(await stdout.read())
asyncio.run(main())
📊 Performance Benchmarks
SpindleX is optimized for high-throughput environments, with SFTP upload throughput in line with leading SSH libraries and ChaCha20-Poly1305 as the preferred cipher. See the comparison page for the full benchmark methodology.
| Operation | SpindleX | Other libs | Notes |
|---|---|---|---|
| SFTP upload (1 MiB, chacha20) | ~14 ms | ~14 ms | On par after limits negotiation |
| SFTP upload (1 MiB, AES-CTR) | ~14 ms | ~14 ms | Pipelined, 255 KB chunks |
| Handshake | ~320 ms | ~320 ms | Ed25519 + Curve25519 |
🛡️ Security
- Verification Enforced: Host key verification is mandatory by default.
- Log Sanitization: Credentials and sensitive data are automatically filtered from logs.
- AEAD Preferred:
chacha20-poly1305@openssh.comis the default cipher - authentication is integral, no separate MAC. - Terrapin Defense: Strict-KEX (
kex-strict-c-v00@openssh.com) enabled, sequence numbers reset after NEWKEYS. - Modern Defaults: Ed25519, ECDSA, ChaCha20-Poly1305, and AES-CTR only. SHA-1 and CBC mode are excluded.
- Full Policy: See SECURITY.md for vulnerability reporting and Security Guide for operational security guidance.
🤝 Contributing
Contributions are welcome. See CONTRIBUTING.md for the GitHub entry point and docs/contributing.md for the maintained guide.
Distributed under the MIT License. See LICENSE for more information.
SpindleX Project © 2026 Stratza Labs
2 maintainers
Metadata
2 maintainers
Release files for spindlex 1.0.2
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| spindlex-1.0.2.tar.gz | 159.1 kB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| spindlex-1.0.2-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 331.7 kB
Release files / spindlex-1.0.2.tar.gz
| Download URL | spindlex-1.0.2.tar.gz |
|---|---|
| Size | 159.1 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
16b0c147bbfcc430dd9ce1a324b0a7b1c07a0eff5abacf39017a8bc4b359a545
|
|
BLAKE2b-256 checksum How to use checksums |
1c845656d3c91b7dd26c9f9983c56964d7b93209abef3397640612f2daeb78ed
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 6, 2026.
Transparency logRelease files / spindlex-1.0.2-py3-none-any.whl
| Download URL | spindlex-1.0.2-py3-none-any.whl |
|---|---|
| Size | 172.6 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
4c87e1b4a9dc404f9fefc2de5c90b1f9e515fdb3197bc3b27d8d2770888a9967
|
|
BLAKE2b-256 checksum How to use checksums |
d09e56038841bc380b1b8a2b65b3e75a7256753e88e4e48c64a655596d7816ea
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 6, 2026.
Transparency log
