Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations were provided, so the description carries the full burden. It discloses that the tool is read-only, returns metadata only, does not return file bytes, does not modify attachments, requires Full Disk Access, and structurally neutralizes untrusted content (filenames, MIME types, paths, sender labels). These details fully inform the caller of side effects, permissions, and security measures.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.