Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover the safety profile (readOnly, idempotent, non-destructive), and the description adds substantially more: 0.1-2 s latency, USD 0.02 price, a 10-query/IP/UTC-day free tier, and a prompt-injection warning treating endpoint names/urls/on-chain strings as untrusted data. Cost, rate limits and injection risk are precisely the operational facts annotations cannot carry.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.