Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Well beyond the readOnly/idempotent annotations, it discloses matching semantics (all words must appear, case-insensitive), result ordering (newest first), and the untrusted-third-party status of title/body/author_name/reply with an instruction to treat them as data only — a genuine prompt-injection safeguard. It also warns that a setup_required response must not be reported as zero reviews.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.