Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. It states the primary side effect (sending a password reset email) but does not disclose any additional behavioral traits such as permission requirements, idempotency, rate limits, or what the user experience entails beyond the email being triggered.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.