Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, so the [READ] tag is redundant. The description does add real behavioral scope beyond the annotation: only the latest scan, and registry-wide rather than per-project or per-artifact. It says nothing about freshness, resolution, or failure states of the scheduled scan.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.