Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Goes well beyond the readOnlyHint annotation: requires login, contacts hidden by default, an explicit consent flag is mandatory, and shared contacts are returned only when the request is ACCEPTED and still visible. It also states a negative guarantee — login phone and profile contact details are never returned — which is exactly the privacy context an agent needs before invoking it.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.