Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations supplied, the description carries the full disclosure burden; it does add real value by declaring the login/authentication requirement and by framing the operation as a non-mutating status query. It says nothing about what happens when the card is absent or the user is logged out, and does not describe error or empty-state behavior. Given an output schema exists, the missing return-value detail is excusable, but the auth and no-side-effect context is the only behavior surfaced.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.