Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Goes well beyond the annotations, which already declare readOnly/idempotent/non-destructive/closed-world. It adds that inputs are not stored or logged and, crucially, that a valid result proves only checksum correctness, not real-world existence or ownership — a semantic caveat an agent cannot infer from annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.