Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations cover the safety profile (readOnly, idempotent, non-destructive), yet the description adds substantial context beyond them: YAML restricted loader refusing alias bombs, XML with DTDs/entities returning 422 xml_forbidden, lossy conversions surfaced as 422 instead of silent changes, CSV strings / ISO date coercion, isolated no-network child process, latency and 1 MB caps, pricing, free tier, and a no-logging guarantee. This is far richer than the annotations alone.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.