Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of behavioral disclosure. It reveals that IDs are stable (useful for referencing) and that findings have paths, but does not clarify the return format, whether the operation is read-only (though 'list' implies it), or any state requirements such as needing a completed fuzzing campaign.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.