Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the annotations (readOnlyHint=false, openWorldHint=true, destructiveHint=false), it discloses the security posture ('anyone holding the link can download'), the expiry ceiling (default 24, max 720 = 30 days), that a token and expiry are returned, and the confirm-gated first call. That is exactly the mutation/authorization context annotations don't carry. It only omits that each call mints a distinct link (non-idempotent), a small gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.