Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and destructiveHint=false, so the read-only behavior is covered. The description adds useful context in the form of the required scope (security:read) and the concrete endpoint path. It does not describe response shape, pagination, error behavior, or what fields a scan object contains, but for a simple read-only GET with strong annotation coverage this is acceptable.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.