Dropbox Integrates MCP and Dash to Close the Gap between Security Design and Code Review

Dropbox has introduced a new engineering approach that connects security design artifacts directly with code review workflows using Model Context Protocol (MCP) and its internal knowledge system, Dash. The initiative aims to address a persistent gap in large engineering organizations: security requirements are typically defined during design reviews, but enforcement and verification occur much later, during code reviews, often without full context. In many teams, threat models, design documents, and security requirements are created as standalone artifacts and stored separately from the codebase. As systems evolve, these documents often become stale or disconnected from implementation details. This leads to a recurring problem where engineers and reviewers must manually trace security intent back to code changes, increasing the likelihood of missed requirements or inconsistent enforcement. Dropbox’s approach uses Dash as a centralized indexing and retrieval layer across internal documentation systems. Dash preserves existing access control policies while making organizational knowledge queryable. MCP provides a standardized protocol layer that enables AI systems to retrieve and use this context in developer workflows, such as code review. When a pull request is created, the system identifies relevant code changes and uses MCP enabled retrieval…