Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Goes well beyond the annotations by disclosing the credential-like nature of the returned URL, its expiry window, the immediate-revocation alternative, the audience restriction (only a signed-in member can open it, the caller cannot), and the exact error conditions. Annotations only say it is a non-idempotent write in an open world; the description adds the security-relevant behavior an agent must respect.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.