Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does disclose the key behavioral trait: unauthenticated callers get a public receipt subset while the owning API key gets the full proof. That auth-tiered response shape is real value beyond structured fields. It omits error behavior for unknown UUIDs and whether status is mutable or cached.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.