Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only declare readOnlyHint, so the description adds real value: it discloses the response shape (userId, email, name) despite there being no output schema, and flags the call as cheap, which supports using it as a credential preflight. It does not describe failure behavior (e.g. auth errors) or rate limits, keeping it short of a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.