Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden, and it does disclose the conceptual contents of the response (structural, runnable, and backend-compatibility states), which partially substitutes for the missing output schema. However, it never states that the operation is read-only/non-destructive, whether it touches the backend or is purely local, or what happens on invalid input, so the safety and side-effect profile must be assumed from the name alone.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.