Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, destructiveHint=false, and openWorldHint=false, so the agent knows this is a safe read-only operation. The description adds 'Returns metadata only'—a useful disclaimer that goes beyond the schema. However, it does not detail what 'metadata' includes (e.g., supported versions, installation status), but the annotations carry most of the safety burden. This is slightly better than a baseline 3 because it explicitly limits scope, yet not rich enough for a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.