Option C directly searches source-file contents for imports of @company/auth . Anthropic’s Claude Code tools reference states that Grep locates patterns within files, while Glob matches filenames and paths. The search can account for the repository’s supported module syntaxes, including static imports, require() calls, dynamic imports, and re-exports. It can also restrict results by file type or directory when appropriate. Option A identifies packages that declare the dependency but does not prove which source files import or invoke it; workspace-level dependency declarations may cover many packages. Option B finds authentication-related filenames, which are unrelated to whether a file imports the package. Option D searches directory names and therefore has the same limitation. After Grep returns the matching files and line numbers, the agent can read the surrounding code to determine whether each import supports middleware registration, token verification, authorization checks, or re-exporting. This produces an accurate usage inventory while minimizing context consumption and unnecessary file reads.

================