Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already establish this is a safe read of a closed scope, so the bar is lower. The description adds genuinely non-obvious behavior: returned third-party text is wrapped in 'untrusted_content' with a '_notice' and must be treated as data, not instructions — important prompt-injection context the annotations cannot convey.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.