How Dropbox uses MCP and Dash to close the design-to-code security gap

This post details the architecture of a system that uses Model Context Protocol (MCP) and Dash to automatically retrieve relevant threat models during code review. It leverages foundational LLMs to compare documented security requirements with proposed code changes, identifying gaps and improving traceability. The system was validated by analyzing security design reviews and their implementing code changes, revealing that only 12% of PRs explicitly linked to their threat models, with 69% of connections discoverable only through semantic search. The system aims to surface security findings that would otherwise be missed.