Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint and closed-world behavior, so the bar is lower, yet the description adds real operational context: it will not disclose role tokens or extend the fixed expiry, and it requires the read token. It does not mention rate limits or whether counts are eventually consistent, which keeps it off a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.