Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover the safety profile (readOnlyHint, idempotentHint, destructiveHint=false), and the description adds a genuine extra guarantee beyond them: returned data excludes tokens, codes, and signing secrets, which tells the agent what it will and won't see. It doesn't mention pagination or whether inactive/disconnected integrations are included.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.