Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the transparency burden. It indicates a non-destructive action ('validate' and 'show') and adds a key behavioral guarantee: 'without exposing secrets'. However, it doesn't disclose what happens on invalid tokens, the response format, or any potential side effects. It meets the baseline but lacks deeper behavioral context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.