Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover readOnly/idempotent/non-destructive, and the description adds genuinely new behavior: the required `payments:read` scope, the cursor round-trip protocol for paging, and a security note that free-text content arrives under `untrusted_fields` and must not be treated as instructions. That last point is a valuable, non-obvious operational constraint an agent could not infer from structured fields.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.