Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full disclosure burden, and it does the important work: it declares 'Read-only' and specifies the auth requirement (platform staff, account session). It stops short of describing latency, failure modes, or whether the call can be expensive, but the core safety and access profile is present.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.