Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It does add value by noting that the password is shown masked, which is a non-obvious behavioral detail. However, it does not explicitly state whether the operation is read-only, nor does it mention any side effects, permissions, or error behavior. The masking note is a positive but insufficient disclosure for a tool with zero annotation support.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.