Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden, and it does disclose two non-obvious traits: the state is local, and cookies are never returned (a useful privacy guarantee). However, it does not say whether authentication is required, what happens when the token has already expired, or that the call is strictly read-only, so meaningful gaps remain.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.