Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare read-only/idempotent/non-destructive, and the description adds substantial context beyond them: required scopes (agent.inbox.read, agent.read), agent-scoped bearer key requirement with impersonation limits, sandbox-key restriction, absence of context_version, and an explicit statement that document text is untrusted data. It also enumerates operations this tool does NOT perform (image URLs, OCR trigger, retry, receipt, email, charge).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.