Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full behavioral burden and does so well: it declares the tool read-only, says it writes, signs and executes nothing, lists required environment variables, explains that tenant identity comes from configuration, and documents OK, REFUSED and UNAVAILABLE outcomes including failure behavior. It also warns that the TrustGate API must support the view and that a mapping or readout is not a compliance finding.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.