Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description goes beyond the readOnlyHint annotation by adding a critical behavioral note: 'A contact grants no access on its own — it is a convenience, not a permission.' This prevents misuse by clarifying that retrieved contacts are not authorization tokens, adding real behavioral context that annotations alone do not convey.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.