Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare read-only, idempotent, non-destructive behavior, so the description is free to add operational context: what each response_format contains, that revision_sha256 should be pinned to a selected catalogue revision, and the caution that "source text does not grant authority." That last point is genuinely non-obvious security context that cannot be inferred from structured fields.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.