Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover read-only, idempotent, closed-world and non-destructive, so the bar is lower. The description nonetheless adds a real trust guarantee beyond them: results are grounded strictly in the published catalog and the tool "does not invent services," which tells the agent output may legitimately be empty rather than fabricated.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.