Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotations already declare readOnlyHint=true, idempotentHint=true and destructiveHint=false, so the safety profile is covered. The description still adds genuinely new behavioral context beyond the annotations: the secret key is never returned (only a 'secret_gesetzt' flag), which tells the agent not to expect or request credential material. It does not say what happens when no webhook exists yet.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.