Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Goes well beyond the readOnly/idempotent annotations: discloses the 1 MB input cap, the 2,000-event cap with a `truncated` marker, that only VEVENT is returned (to-dos/journals/alarms skipped), that unknown TZIDs stay floating with a per-event warning, that all-day `end` is inclusive, that non-VCALENDAR input yields an uncharged 422, typical latency, price, and the untrusted-data warning. This is the exact behavioral context annotations cannot carry.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.