Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint and idempotentHint, so the description only needs to add extra context. It adds that the tool returns hashes and is for integrity verification, which is helpful but does not disclose any additional behaviors such as return format, performance, or prerequisites. Given the simplicity and annotation coverage, a score of 3 is appropriate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.