Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already establish readOnly, idempotent, non-destructive, so the safety profile is covered. The description adds genuine value beyond that by disclosing a redaction rule: secret parameter values and the signing secret are never returned, which tells the agent not to expect full configuration even in the returned object. It stops short of noting error behavior for an unknown ID.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.