Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Despite annotations only saying readOnly=false, openWorld=false, idempotent=false, destructive=false, the description discloses substantial behavioral nuance: autonomous runs cost money and settle against a BYO key first, workflow runs are free/deterministic, and the call can legitimately return a SKIPPED error for specific business reasons rather than silently succeeding. It also states what success returns and directs the caller to get_agent_run. This is exactly the kind of side-effect and failure-mode transparency annotations do not provide.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.