Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark the tool read-only, idempotent, and non-destructive; the description adds substantial behavioral context: versioned server-side content, a recommendation to re-fetch rather than cache, deterministic no-LLM field lookups, override semantics between `field` and `name`, and the leakage-classification safety rule that only `feature` columns are safe as selection inputs. This goes well beyond what annotations provide.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.