That's the exact framing behind hintgap - the annotation is the permission model, not documentation. If destructiveHint/readOnlyHint is missing, the agent reasons about blast radius from the name and description alone, and a vague description invites precisely the "guess the argument shape, server accepts a wider call" failure you describe.

On your two questions:

Sensitive or public schema? It's public schema - the description/annotation ships to any client that lists your tools, so it must never carry secrets, internal hostnames, or auth hints. But it's security-relevant public schema: it defines what the agent believes it's allowed to do, so it deserves review like an authz policy, not a changelog.

What to log when the agent picks the wrong tool? The decision context, not the payload: the tool name chosen, which annotations were present/absent at call time, and the shape of the arguments (keys/types, not values). That tells you whether the miss was a missing hint, an ambiguous description, or a genuine model error - which is exactly the signal you feed back into tightening the schema.