Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and destructiveHint=false, so the safety profile is covered. The description does add genuine behavioral context beyond that: returned related fields are masked for unauthorized users, meaning the response content depends on the caller's permissions. However, it never clarifies which fields count as 'related' or what 'unauthorized' means in practice, leaving the disclosure cryptic.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.