Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Goes well beyond the annotations by disclosing the one-time-link flow, that credentials are never transmitted through chat, that the response carries connection_string_format and auth_note which must be surfaced verbatim, and the mssql/Entra edge case with an explicit warning against constructing a URL connection string. This is exactly the kind of operational context annotations (readOnlyHint=false, destructiveHint=false) cannot convey.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.