How Dropbox uses MCP and Dash to close the design-to-code security gap

Dropbox's security-review system compares proposed code with the protections agreed upon during design. Its Dash search service retrieves relevant threat models, documents describing risks and required safeguards, through MCP, an interface that gives AI tools access to that information. A model then checks the requirements against the code, bringing potentially missing protections into the existing review process. Dropbox's account leaves final judgment with human reviewers.

In an analysis of 150 security design reviews, Dropbox linked 80% to implementing code changes. That measures its ability to reconnect documentation and implementation, rather than vulnerability-detection accuracy. The useful capability is making an earlier security decision available when someone reviews the code meant to enforce it.