Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly/idempotent/non-destructive; the description adds operational context: commands run inside a sandboxed virtual filesystem (rg, cat, head, tree, ls) and paths are documentation pages, not customer org data. It does not mention what output looks like, but the behavior it discloses goes beyond the annotations without contradicting them.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.