How Dropbox uses MCP and Dash to close the design-to-code security gap (opens in new tab)

Dropbox found a significant gap between security design reviews and implementation. Only 12% of implementing pull requests linked back to their original threat models, and the median delay between review and code submission was about five weeks. To close this gap, Dropbox built a system using Dash, Model Context Protocol (MCP), and foundational models to automatically retrieve relevant security requirements and compare them with code during review.

The Design-to-Code Gap

• Threat models document risks, attack scenarios, and agreed-upon mitigations during security review.
• These documents often remain in wikis or documentation systems, while implementation happens later through pull requests.
• At Dropbox:
  • Only 12% of implementing PRs linked to their original design review.
  • Among 79 verified pairs, 54% of PRs were opened more than a month after the review.
  • The median delay was approximately five weeks, with some delays exceeding 11 months.
  • Only 29% of PRs were opened within two weeks of the security review.
• About 15% of design reviews were filed retroactively, suggesting that some security-sensitive work was not identified early enough.

Why Existing Tools Fall Short

• Static analysis can detect whether certain security patterns or controls exist.
• It generally cannot determine whether those controls satisfy the specific requirements agreed upon during design review.
• Manual linking between PRs and threat models depends on engineers remembering additional workflow steps.
• Reminder bots may improve compliance temporarily, but adherence tends to decline.
• The core problem is not a lack of security documentation; it is the difficulty of making that existing context available during implementation.

Dash and MCP as a Context Bridge

• Dash already indexes Dropbox content and connected applications, including threat models and engineering documentation.
• Dropbox used Dash’s MCP server to let an AI security agent search and read this content.
• MCP provides a common interface for bringing multiple context sources into one agent session.
• When a PR is opened, the agent retrieves relevant threat models and supporting documents.
• A foundational model then compares the documented requirements with the proposed code.
• For example, it can identify whether code implementing an endpoint enforces authentication required by the corresponding threat model.
• Unlike traditional static analysis, this approach evaluates code against documented security intent, not just known code patterns.

Integrating Security into Code Review

• Dropbox surfaced the system directly within the existing code-review workflow rather than creating a separate security process.
• This allows developers and reviewers to receive relevant security context where implementation decisions are already evaluated.
• The same mechanism can potentially identify missing reviews when code appears security-sensitive but has no corresponding threat model.

Dropbox’s approach shows how retrieval and AI reasoning can reconnect design decisions with implementation. Organizations can apply the same pattern beyond security—for example, to compliance requirements, privacy reviews, accessibility standards, or other design-to-code checks.