How Dropbox uses MCP and Dash to close the design-to-code security gap

Dropbox built a system combining Model Context Protocol (MCP), foundational LLMs, and Dash to automatically connect security threat models with code reviews, closing the gap between design decisions and implementation.

• •Only 12% of implementing PRs link back to their original security design review, with 54% of PRs created over a month after the security review was filed
• •Traditional static analysis tools cannot verify whether code implements security requirements agreed upon during design review
• •The system retrieves relevant threat models during code review using Dash's semantic search capabilities via MCP
• •Semantic search successfully linked 80% of design reviews to implementing code changes, with 69% of connections only discoverable through semantic search
• •