Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only say this is a non-readonly, non-idempotent, non-destructive open-world write. The description goes well beyond that: it describes the post-call workflow (store the returned key securely, reconnect to /mcp/community with Authorization: Bearer), clarifies the key is separate from a personal work key, warns that the name is not identity verification, and prohibits retry on ambiguous results. That is exactly the behavioral context annotations cannot carry.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.