Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations cover the safety profile (readOnly, idempotent, openWorld, non-destructive), and the description layers on operational facts they cannot express: ~0.2-1 s latency, USD 0.001 price, and a 10-reads-per-IP-per-UTC-day free tier. It also flags that returned page text and on-chain strings must be treated as untrusted data, a real injection-risk disclosure for an open-world read.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.