Built-in Tools
Claude's built-in tools each have a precise job. Learn Grep vs Glob, Edit-first modification, and incremental discovery to avoid wasting context.
Alongside custom and MCP tools, Claude ships with built-in tools for working directly with a codebase: Read, Write, Edit, Bash, Grep, and Glob. Each has a precise purpose, and choosing the wrong one wastes tokens or floods the context window. The exam tests whether you know which tool fits which job.
Grep vs. Glob
The single most tested distinction: **Grep searches file *contents*; Glob matches file *paths*.** Use Grep to find text inside files — a function's callers, an error string, an import. Use Glob to find files by name, extension, or directory pattern.
| Goal | Tool | Example query |
|---|---|---|
| Find callers of processOrder() | Grep | processOrder |
| Find lines importing an auth module | Grep | import.*auth |
| Find every test file | Glob | **/*.test.tsx |
| Find config files | Glob | **/config.* |
Using Glob to find code — reaching for a path matcher to locate a function's callers returns files by name, not the lines that call it, so the real usages are missed.
Glob("**/processOrder*") // matches filenames, not callersGrep searches contents; Glob matches paths. Use Grep to find text inside files (callers, imports, error strings); use Glob to find files by name or extension.
Grep("processOrder") // finds every callerGrep finds what is INSIDE files. Glob finds files by their NAMES. Using Glob to locate function callers, or Grep to find files by extension, is the classic wrong-tool trap.
Edit is the default for changes
Edit makes targeted changes by matching a unique text anchor and replacing it. It is precise because it touches only the identified text — and it refuses to run when the anchor matches multiple places, which is a safety feature, not a bug. Reaching for Read + Write on every modification is penalized.
old_string: "function processOrder(id: string)"
new_string: "function processOrder(id: string, validate: boolean = true)"- 1Try Edit with the shortest plausible unique anchor.
- 2On a non-unique match, widen old_string with surrounding context, or set replace_all: true.
- 3Fall back to Read + Write only when neither of the above works.
When Edit reports a non-unique match, widen the anchor or use replace_all — do not immediately jump to Read + Write. The exam penalizes defaulting to Read + Write instead of trying Edit first.
Incremental discovery
Reading every file upfront burns the context window on irrelevant code. The right pattern is incremental: Grep to find entry points, Read to follow the imports, Grep again to trace usage through wrappers, and Read only the files that earn it. This gives minimal context for maximum understanding.
To find every caller of a deprecated function and its tests: Grep the function name for direct references, Glob for the sibling test files, then Grep the wrapper names to catch indirect coverage that a single search would miss.
How the exam will try to trick you
The distractors below look right under time pressure — learn the tell.
- The trap
Use Glob to find a function's callers, e.g.
Glob("**/processOrder*").Correct answerUse Grep to search file contents for the function name.
Why: Glob matches file paths, not the lines that call the function, so real usages are missed.
- The trap
Use Grep to find files by extension or naming pattern.
Correct answerUse Glob for path-based searches like
**/*.test.tsxor**/config.*.Why: Glob is purpose-built for matching paths; Grep is for what is inside files.
- The trap
Read every source file upfront before deciding what is relevant.
Correct answerDiscover incrementally — Grep for entry points, then Read only the files that earn it.
Why: Loading every file into context is a context-budget killer.
- The trap
Default to Read + Write for every file modification.
Correct answerReach for Edit first — it touches only the matched anchor.
Why: Edit is faster and uses less context because it changes just the identified text.
- The trap
Jump straight to Read + Write the moment Edit reports a non-unique match.
Correct answerWiden
old_stringwith surrounding context or setreplace_all: truebefore escalating.Why: The non-unique refusal is a safety feature, not a signal to abandon Edit.
Key takeaways
- Claude's built-in tools are Read, Write, Edit, Bash, Grep, and Glob, each with a distinct job.
- Grep searches file contents; Glob matches file paths — never swap them.
- Edit is the default modification tool; its non-unique-match refusal is a safety feature.
- On a non-unique Edit match, widen the anchor or use replace_all before Read + Write.
- Discover codebases incrementally: Grep, Read, Grep again — never preload every file.
- Combine Grep and Glob to trace deprecated functions across wrappers and their tests.
Frequently asked questions
What is the difference between Grep and Glob in Claude Code?+
Grep searches inside files for text patterns, so you use it to find function callers, error messages, or imports. Glob matches file paths by name or extension, so you use it to find test files, config files, or files in a directory. In short, Grep finds what is inside files and Glob finds files by their names.
When should Claude use Edit instead of Write?+
Edit is the default for modifying existing files because it makes a precise, targeted change by matching a unique anchor. Write replaces an entire file and should be a last resort. If Edit reports a non-unique match, widen the anchor or set replace_all rather than falling back to Read plus Write.