Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations mark the tool readOnlyHint=true and destructiveHint=false, but the description says it 'opens a 7-day PASS window' and instructs the agent to 'Burn via POST /v1/session/cert + X-SQLGuard-Session.' Opening a window and burning a session cert imply state mutation/destruction, directly contradicting the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.