Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and destructiveHint=false, so the safety profile is fully covered by structured data. The description's added content ('Covers iPhone and Android, via QR code or manual entry') merely restates the two enum parameters rather than disclosing anything new about behavior. With an output schema present, no return-value explanation is required, so a baseline 3 is right.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.