Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Given no annotations, the description carries full burden. It transparently states that only the key prefix and creation time are returned, not the full key, which manages expectations. However, it does not mention whether all keys are returned or pagination, nor any permission requirements.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.