Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare destructiveHint=true, and the description goes well beyond that with the two-phase confirmation protocol: first call deletes nothing, returns the set plus a confirm_token, tokens last ten minutes, survive reconnects, and completed retries return their original result. This is exactly the idempotency and safety context an agent needs for a destructive batch operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.