Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover readOnly, idempotent, and non-destructive behavior, so the description does not need to repeat that. It adds useful behavioral details beyond the annotations: requires authentication, recent breaches limited to 7 days, and the types of data shown (status, error budgets). This provides meaningful context for what the tool returns and its access prerequisites.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.