You are building developer-productivity tools using the Claude Agent SDK.

Option B uses the tool designed to search file contents. Anthropic’s Claude Code tools reference distinguishes Grep from Glob: Grep searches lines inside files, whereas Glob matches filenames and paths. Grep is built on ripgrep and accepts regular-expression patterns, so the opening parenthesis should be escaped as eval\( when the intention is to match the literal function call. The search can return matching files, line numbers, and surrounding context without loading every file into the model’s context window. Option A searches filenames resembling eval , not source files whose contents invoke the function. Option C follows only code reachable from a selected entry point and can miss test utilities, dynamically loaded modules, scripts, and dormant vulnerable code. Option D combines a recursive filename listing with text filtering; it still searches names rather than file contents. After Grep identifies matches, the agent should use Read on the relevant ranges to distinguish actual executable calls from comments, strings, or safe wrappers. Grep therefore provides the most complete and context-efficient initial security scan.

================