Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Goes well beyond the annotations: discloses the createReadings scope requirement, that a chart may be saved, the readReadings-scoped return of only owned purchase state, that no payment or model generation starts, and that an explicitly empty preview is possible. It also flags injected names as untrusted content, which is exactly the kind of security context annotations cannot carry.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.