Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Goes meaningfully beyond annotations by disclosing that the server supplies its own API keys, that calls are rate-limited, that only whitelisted model IDs are accepted, and which providers back which models. Annotations cover the safety profile and an output schema exists, so remaining gaps are minor.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.