Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, so the read-only nature is covered. The description adds genuinely useful context beyond that: the data is 'Sensitive personal data', which signals handling caution, and it exposes the underlying endpoint. It does not, however, describe auth requirements, what happens with invalid ids, or the shape of the salary items.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.