Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only give readOnlyHint=false, destructiveHint=false, openWorldHint=false, but the description discloses a nuanced write policy: read passthrough, a specific allowlisted write pilot gated on client capability, a legacy-client read-only fallback, and hard blocking of dangerous writes. This goes well beyond the annotations and is consistent with them, so there is no contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.