Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Goes well beyond the annotations: it discloses the verdict vocabulary (PASS/FIX/BLOCK with 0-100 score, INCONCLUSIVE with null score when authorization is required), the scope limit that the verdict covers the protocol and never tool correctness, and the presence of a what_this_does_not_prove field. It also explains that a refusal of invented arguments is not scored (tool_behaviour: refused_placeholder), which prevents misreading a FIX result.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.