Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and destructiveHint=false, but the description adds synchronous execution, forbidden task support, no publication authority, and concrete output-handling rules: use assistantSummary first, do not show raw JSON, and mention IDs only when useful. 'Classification: read-only' repeats the annotation, but the operational context goes beyond structured fields.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.