Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover readOnly/idempotent/non-destructive/closed-world, and the description still adds substantive context: exactly which factors build the risk score (churn, files touched, sensitive paths, test-file changes, lint severities, impacted risk areas) and an explicit limitation that it does not read code semantically. It also redirects the reader to the notAnalysed field for unanalysed areas — genuinely beyond what the annotations say.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.