Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover the safety profile (readOnlyHint/openWorldHint/destructiveHint all false), so the bar is lower, and the description still adds real context: 'starts nothing, charges nothing and does not contact the app', plus the requirement to obtain an explicit yes and the one-time offering rule. It does not describe how long the resulting check takes or what the returned link looks like, but for a read-only link-generation tool this is close to complete.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.