Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already establish readOnly, idempotent, non-destructive, closed-world behavior, so the description only needs to add context. It does add useful behavioral context: the identity returned is the OAuth-authorized human, it includes role and teams, and connection scopes or identity restrictions may shrink the toolset. It omits what happens when the token has no associated human principal.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.