Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the annotations (destructive, idempotent, open-world), it discloses cascade behavior (messages are deleted too), an approval-mode 202 path that leaves the inbox present until a verified owner confirms an emailed link, the persistence of approval mode on username recreation, ownership scoping, and the inbox_not_found error for another account's inbox. It also warns that an API key cannot submit the confirmation link, which is real operational context an agent cannot infer.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.