Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover the safety profile (readOnly, idempotent, non-destructive), and the description adds genuinely new context: synchronous execution, task support forbidden, and that the returned JSON is internal orchestration state that must not be surfaced raw. 'Classification: read-only' merely repeats the annotation, but the output-handling constraints add real value.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.