Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the annotations (readOnly, idempotent, non-destructive), the description discloses significant behavioral traits: it explicitly says 'It does NOT do data-flow analysis', cannot follow values across functions/files, and that empty results are not safety verdicts. It also notes the response lists what it did not analyse, which is rich, actionable transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.