Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare readOnlyHint=false, destructiveHint=false and idempotentHint=false; the description adds the useful nuance that the SQL itself is read-only while an optional materialisation step creates derived datasets. However, 'read-only DuckDB SQL' sits in tension with readOnlyHint=false, and the description never resolves it explicitly (what exactly gets written, whether it is reversible, auth requirements). Some added context, but the safety picture is left partly ambiguous.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.