Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already establish readOnly/idempotent/non-destructive, but the description adds behavior they cannot: it never browses live or starts gathering, and it may return one of four states (not_configured, gathering, ready, failed). It also flags pinned notes as untrusted content with an explicit instruction-safety warning, which is exactly the kind of context annotations cannot carry.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.