Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the readOnly/destructive/idempotent annotations, the description explicitly states synchronous execution, 'task support: forbidden', and that the returned JSON is internal application state. It provides detailed output-handling rules (don't expose raw JSON, use assistantSummary, concise human language, suggest next action). No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.