Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations or output schema, the description carries the full behavioral burden, and it only partially does so: it enumerates returned artifacts, which is genuinely useful, but says nothing about whether the run must already exist, what happens for an unknown name, or whether any computation/simulation is triggered server-side. The reading "get" implies read-only, but that is inference rather than disclosure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.