diff --git a/trezor_agent/protocol.py b/trezor_agent/protocol.py
index 9f55268..35096e8 100644
--- a/trezor_agent/protocol.py
+++ b/trezor_agent/protocol.py
@@ -55,7 +55,8 @@ def msg_name(code):
     return ids[code]
 
 
-def _fail():
+def failure():
+    """Return error code to SSH binary."""
     error_msg = util.pack('B', msg_code('SSH_AGENT_FAILURE'))
     return util.frame(error_msg)
 
@@ -95,7 +96,7 @@ class Handler(object):
         code, = util.recv(buf, '>B')
         if code not in self.methods:
             log.warning('Unsupported command: %s (%d)', msg_name(code), code)
-            return _fail()
+            return failure()
 
         method = self.methods[code]
         log.debug('calling %s()', method.__name__)
@@ -142,7 +143,7 @@ class Handler(object):
         try:
             signature = self.signer(label=label, blob=blob)
         except IOError:
-            return _fail()
+            return failure()
         log.debug('signature: %s', binascii.hexlify(signature))
 
         try:
diff --git a/trezor_agent/tests/test_client.py b/trezor_agent/tests/test_client.py
index 438d7cb..b635b8e 100644
--- a/trezor_agent/tests/test_client.py
+++ b/trezor_agent/tests/test_client.py
@@ -114,6 +114,8 @@ def test_ssh_agent():
         assert r[1:] + s[1:] == SIG[1:]
 
         c.client.call_exception = ValueError
+
+        # pylint: disable=unused-argument
         def cancel_sign_identity(identity, challenge_hidden,
                                  challenge_visual, ecdsa_curve_name):
             raise c.client.call_exception(42, 'ERROR')
@@ -122,6 +124,7 @@ def test_ssh_agent():
         with pytest.raises(IOError):
             c.sign_ssh_challenge(label=label, blob=BLOB, visual='VISUAL')
 
+
 def test_utils():
     identity = mock.Mock(spec=[])
     identity.proto = 'https'
diff --git a/trezor_agent/tests/test_protocol.py b/trezor_agent/tests/test_protocol.py
index 3d8a625..541fecb 100644
--- a/trezor_agent/tests/test_protocol.py
+++ b/trezor_agent/tests/test_protocol.py
@@ -62,13 +62,13 @@ def test_sign_wrong():
 
 
 def test_sign_cancel():
-    def cancel_signature(label, blob):
+    def cancel_signature(label, blob):  # pylint: disable=unused-argument
         raise IOError()
 
     key = formats.import_public_key(NIST256_KEY)
     h = protocol.Handler(keys=[key], signer=cancel_signature)
 
-    assert h.handle(NIST256_SIGN_MSG) == protocol._fail()
+    assert h.handle(NIST256_SIGN_MSG) == protocol.failure()
 
 
 ED25519_KEY = 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFBdF2tjfSO8nLIi736is+f0erq28RTc7CkM11NZtTKR ssh://localhost'  # nopep8