Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, destructiveHint=false, and openWorldHint=false, so 'Classification: read-only' largely repeats them. The description nevertheless adds context beyond the annotations: synchronous execution, task support forbidden, and substantial output-handling behavior (JSON is internal application state, use assistantSummary first, never display raw JSON, mention IDs only when useful).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.