How Dropbox uses MCP and Dash to close the design-to-code security gap

Summary

Dropbox developed a system using the Model Context Protocol (MCP) and Dash's semantic search to bridge the gap between security threat models and code implementation. By retrieving original security documents during pull requests, an LLM agent automatically evaluates whether the proposed code adheres to previously agreed-upon security requirements. This approach surfaces design regressions and missing controls that traditional static analysis tools miss.

Takeaways

1. 1

   Only 12% of pull requests explicitly link back to their original security design reviews, and over half are opened more than a month after the review occurred.

2. 2

   Using semantic search via Dash's MCP server, Dropbox successfully mapped 80% of design reviews to implementing code, with 69% of connections only discoverable through semantic matching.

3. 3

   LLMs integrated directly into code review workflows can compare implementation against design intent, catching security gaps even when code is functionally correct.