Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only say readOnlyHint=false and not idempotent; the description goes much further, disclosing that a confirmation email is sent, that monitoring does not begin until the recipient opens the link and confirms on the page, and that this call itself sends exactly one email. That is exactly the side-effect context an agent needs for a non-read-only, open-world tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.