Dropbox Integrates MCP and Dash to Close the Gap Between Security Design and Code Review

Dropbox has integrated Model Context Protocol (MCP) with its internal knowledge platform, Dash, so security design context can surface during AI-assisted code reviews. The setup targets a familiar failure mode: design and threat modeling live in one place while review happens in another, so reviewers and AI tools often judge code without the original security intent.

The integration uses MCP as the bridge between review tooling and Dash. When a pull request is under review, the system retrieves the related threat models and security requirements from Dash and makes that material available to the AI-assisted review flow. Reviewers can then check whether the implementation matches the design intent those artifacts already capture, rather than relying only on the diff and tribal knowledge.

For engineers and builders, that closes a practical gap. Security requirements and threat models are only useful if they are present when someone is approving code. Attaching them to the pull-request path reduces the chance that a design control is assumed, restated incorrectly, or never checked against what shipped.

The market context is the rise of AI-assisted code review inside large product orgs. Tools that only summarize diffs still miss design-time security decisions. By wiring MCP to an internal knowledge platform rather than a one-off prompt, Dropbox is treating security design as live context for review, not as static documentation outside the workflow.

InfoQ’s Q&A covers the architecture and the lessons Dropbox drew from the integration. What to watch next is whether similar MCP-plus-knowledge-platform patterns show up for other design artifacts—compliance controls, data-handling rules, and service-level security baselines—and how reliably those retrievals stay scoped to the right pull requests.