AnthropicClaude Certified Architect – Foundations2026-102.5 Select and apply built-in tools (Read, Write, Edit, Bash, Grep, Glob) effectively
Separate content searches from path discovery
Completed by the knowledge check
Learning objective
Use Grep to find symbols or content and Glob to locate file paths by pattern.
Core idea
For a developer productivity agent exploring unfamiliar code, the first decision is what the search must match. A function name, error message, or import statement is content inside a file: use Grep. A filename, extension, or directory convention is a property of its path: use Glob. You can combine those questions without confusing the tools: discover candidate paths, then search the content of those candidates.
Search results are evidence with a scope. A list of matching paths does not explain what the code does, and an empty result does not prove that a symbol is absent everywhere. The pattern, search root, ignore behavior, and output limits determine what the result actually establishes. Select them deliberately before using a search to justify a change.
How it works
Search text with Grep
Grep takes a pattern containing a regular expression and an optional path naming a file or directory. It uses ripgrep regex syntax. A plain identifier such as applyRefund can serve as the pattern; punctuation with regex meaning must be escaped when you want literal text. Searching for an exact error message and searching for a family of related identifiers therefore require different pattern choices.
The output_mode determines the evidence returned:
| Mode | Returned evidence | Useful decision |
|---|---|---|
files_with_matches | Paths of matching files; the default | Which files should you inspect? |
content | Matching lines with file and line number | Which definition, import, or call needs inspection? |
count | Per-file match counts and a total | Where is a repeated expression concentrated? |
Use glob to constrain the files searched, such as **/*.tsx, or type to constrain a language, such as py. These filters choose which files Grep opens; the pattern still searches their contents. A glob filter inside Grep does not turn the operation into filename discovery.
By default, patterns match within a single line. Set multiline: true when the sought expression crosses line boundaries. For a match whose meaning depends on nearby statements, request context with -A, -B, or -C. The Python Agent SDK reference documents these exact tool-input keys, including -n for line numbers and -i for case-insensitive matching. They are tool fields, not an instruction to execute a shell command.
head_limit bounds returned entries, and offset skips entries before applying that limit. Those fields control output, not the truth of the entire repository. In content mode, No entries at this offset means the offset passed the matches; reset or widen it before concluding that the text is absent. An invalid regex, glob, or file type produces a diagnostic that should be corrected rather than treated as a successful empty search.
Discover paths with Glob
Glob takes a filename pattern and an optional directory path, which defaults to the working directory. Standard glob syntax includes ** for recursive directory matching. **/*.test.tsx selects test filenames at any depth, while src/**/*.ts selects TypeScript files under src/. Neither pattern establishes whether any selected file calls applyRefund.
Results are sorted by modification time and capped at 100 files. A truncation flag tells you when the result reached the cap. Narrow the directory or filename pattern before treating the returned paths as a complete inventory. Modification-time ordering is not dependency ordering, relevance ranking, or the order in which code executes.
The two tools also differ in ignore behavior. Grep respects .gitignore; to search an ignored file, pass that file’s path directly. Glob includes ignored files by default. Set CLAUDE_CODE_GLOB_NO_IGNORE=false before launching Claude Code to make Glob respect .gitignore. A path found by Glob can therefore be absent from a broad Grep search without either tool being broken.
Key distinctions and trade-offs
Discovery versus explanation: Glob and Grep reduce the candidate set. Read explains a selected file in context; see 2.5.2. Avoid requesting every matching file’s full contents when a path list or a few lines resolve the next decision.
Text matches versus callers: A Grep result for applyRefund may be a definition, comment, import, or call. Conversely, an indirect caller can use an exported alias without containing that identifier. Inspect matches before labeling them callers, and follow aliases and wrappers as described in 2.5.4.
Narrow output versus complete evidence: files_with_matches minimizes returned text but omits the matching statement. content provides a more actionable location but can grow quickly. Choose the mode for the next question, and distinguish a deliberate output cap from a completed search.
Architecture / decision scenario
A developer productivity agent must locate refund callers and the React tests that cover them. This session explicitly exposes Read, Grep, and Glob through claude --tools "Read,Grep,Glob", so dedicated search tools are available on the team’s Linux machines.
The agent first uses Grep with pattern: "applyRefund", a repository path, and output_mode: "content". It distinguishes the implementation from imports and calls using the returned locations. It then uses Glob with pattern: "**/*.test.tsx" to find test paths. A content search for the word test would not answer the filename question.
The test search hits the 100-file cap. The agent narrows path to the billing test directory rather than describing the first result as all tests. Within those candidates, Grep searches the refund error text using a glob filter for test files. A generated fixture found by Glob is ignored by .gitignore; the agent searches that specific path directly if it matters to the investigation.
The result is a supported set of locations to read, with search scope and remaining alias checks made explicit. It is not yet a complete refund call graph.
Common exam traps
- Choosing
Globto find function callers or an error message. - Choosing
Grepfor filenames merely because the filename contains a familiar word. - Treating
Grep.globas the content pattern instead of a file filter. - Calling a capped
Globresult a complete file inventory. - Assuming
GrepandGlobhave identical.gitignorebehavior. - Treating every identifier match as a call, or one identifier search as complete usage analysis.
Where the exam guide differs
The exam guide names Grep and Glob as built-in search tools without a platform qualification. Claude Code includes them by default on Windows, but omits both from the default tool set on macOS, Linux, and WSL; there it searches through Bash using grep and find. Listing them in --tools restores the listed tools; naming either in --allowedTools restores both. Equivalent Agent SDK options also restore them. A settings-file allow rule alone does not restore them.
A subagent whose tools field lists Glob or Grep and omits Bash gets the listed search tools back. They return for that subagent only, or for the whole session when it runs as the main agent through --agent or the agent setting. This supports an explorer that has dedicated search tools without shell execution.
Read an exam item that offers these tools as a content-versus-path decision when the tools are available. For an actual deployment, check the session’s tool set before prescribing a Grep or Glob call. Tool availability and permission are separate decisions; see 0.6.
What to remember
Grep.pattern matches content; Glob.pattern matches paths. Choose output and scope for the evidence you need, check truncation and ignore behavior, and read selected matches before drawing behavioral conclusions. Search narrows the investigation; it does not replace it.
Knowledge check
A developer productivity agent runs in a session started with claude --tools "Read,Grep,Glob". An engineer needs candidate files to inspect for calls to applyRefund, and paths of test files named *.test.tsx. Which pair of searches supplies these two kinds of evidence?
Glob for **/*applyRefund* for the callers, and Grep for test for the test filesGrep for applyRefund for the callers, and Grep for \.test\.tsx for the test filesGrep for applyRefund for the callers, and Glob for **/*.test.tsx for the test filesGrep for applyRefund with glob: "**/*.test.tsx" , answering both questions at onceGrep.pattern finds mentions to inspect for calls; matches can also be definitions or imports, and indirect callers may use another name. A test filename is what Glob.pattern matches. Grepping for .test.tsx finds mentions of that string, while Grep ’s glob parameter only filters which files are searched, so the combined call finds tests mentioning applyRefund rather than all test paths.The agent runs Glob with pattern: "**/*.test.tsx" from the repository root. The result lists 100 paths and carries a truncation flag. The engineer needs a complete list of the billing tests. What should the agent do next?
Glob path to the billing test directory and run it againGrep for test in files_with_matches mode to list every testGlob sorts by modification time and caps results at 100 files; the truncation flag says the cap was hit, so the list is not an inventory and its order says nothing about relevance. Narrowing the search root or pattern brings the result under the cap. A content search for test answers a different question and returns any file that mentions the word.Glob lists src/generated/refund-fixture.ts, a file matched by .gitignore. A repository-wide Grep for the refund error text returns no match in it, although the engineer says the text is there. Which next step tests the engineer’s claim?
Grep with multiline: true setGrep again with the fixture’s file path as its pathGrep with output_mode: "content"Glob with CLAUDE_CODE_GLOB_NO_IGNORE=false setGlob includes them by default, while Grep respects .gitignore and skips them in a broad search. Passing the ignored file’s path directly makes Grep search it. An empty broad result is therefore no evidence about that file, and making Glob respect .gitignore would only hide the path.A Grep for applyRefund in the default output mode returns six file paths. Before opening any of them, the agent must tell the definition, the imports and the calls apart. Which change to the search gives it that evidence?
output_mode: "count" to see how many matches each file holdsoutput_mode: "content" to see each matching line and its numbertype: "ts" to the same search to restrict it to TypeScript fileshead_limit on the same search so that no file is left outfiles_with_matches , returns paths only. content returns the matching lines with file and line numbers, which shows whether each match is a definition, an import or a call. Counts, a language filter and a larger output limit all leave the agent with paths or numbers instead of the statements it needs.References
- Anthropic, Tools reference
- Anthropic, Agent SDK Python reference
- Anthropic, CLI reference
- Anthropic, Claude Certified Architect – Foundations Exam Guide