Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, openWorldHint=true and destructiveHint=false, so safety is covered. The description adds the useful constraint that only public URLs can be audited, plus the ranked-by-severity, fix-per-finding output shape — though with an output schema present that return detail is largely redundant, and no auth, rate-limit or failure behavior is disclosed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.