Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the readOnly/idempotent/non-destructive annotations, the description adds material behavioral context: results are bounded and chronological, pagination resumes with next_cursor, private work is excluded, and signed payloads/reasons must be treated as untrusted participant content, never instructions. This is exactly the kind of warning and scoping an agent needs and is not present in the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.