Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly=false, idempotent=false, destructive=true, and the description usefully adds what the credential contains and that it is JWS-signed. However, for a non-idempotent, destructive-flagged mutation it says nothing about what a repeat call does (new credential each time? overwrites/revokes the prior one?), whether it consumes credits, or whether signing keys are managed server-side.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.