Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
readOnlyHint=true already declares the safe-read profile, so the bar is lower. The description still adds real value by disclosing the response shape (JSON:API { data }) and that it contains PII, plus the underlying REST endpoint, which signals sensitivity handling. It does not cover auth, rate limits, or not-found behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.