Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations are only coarse hints (readOnlyHint=false, idempotentHint=false), so the description carries the behavioral burden — and it delivers: it discloses that no new OTP is sent, that the mutation adds `duration` to `expires_at`, that the EXTEND_OTP entitlement (Business or Enterprise) is required, and that some destination countries cause a 403. No contradiction with annotations; readOnlyHint=false aligns with the mutating behavior described.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.