Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover readOnly, idempotent, non-destructive and closed-world, so the bar is lower. The description adds genuinely new behavioral context: results are limited to what the token can read (authorization scoping) and it enumerates the returned fields, which matters because there is no output schema. Pagination and empty-result behavior are still unmentioned.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.