Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already establish readOnlyHint and closed-world scope, yet the description adds a genuinely important behavioral fact: returned third-party text is wrapped in "untrusted_content" with a "_notice" and must be treated as data, not instructions. That trust-boundary disclosure is exactly the kind of context structured fields cannot carry.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.