Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden, and it does disclose two real behaviors: content is pseudonymized and attachment bodies are not fetched. It omits other consequential behavior — whether reading marks the message as read (a separate mark_read sibling exists, implying it does not), permissions, and error behavior when the id is invalid.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.