--- title: Dropbox Integrates MCP and Dash to Close the Gap Between... description: Dropbox has built an engineering system that connects security design artifacts to code review workflows using Model Context Protocol (MCP) and its internal... canonical: https://daily.dev/posts/dropbox-integrates-mcp-and-dash-to-close-the-gap-between-security-design-and-code-review-80j8hevv5 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Dropbox Integrates MCP and Dash to Close the Gap Between Security Design and Code Review | daily.dev og:description: Dropbox has built an engineering system that connects security design artifacts to code review workflows using Model Context Protocol (MCP) and its internal... og:url: https://daily.dev/posts/dropbox-integrates-mcp-and-dash-to-close-the-gap-between-security-design-and-code-review-80j8hevv5 og:image: https://api.daily.dev/og/posts/80J8hEvv5.png og:image:alt: Dropbox Integrates MCP and Dash to Close the Gap Between Security Design and Code Review og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Dropbox Integrates MCP and Dash to Close the Gap Between Security Design and Code Review **[InfoQ](https://daily.dev/sources/infoq)** · 7 min read · 1 upvotes · 0 comments ## Summary Dropbox has built an engineering system that connects security design artifacts to code review workflows using Model Context Protocol (MCP) and its internal knowledge platform, Dash. When a pull request is created, the system retrieves relevant threat models and security requirements from Dash and surfaces them directly in the code review interface. The goal is not to automate security decisions but to reduce context switching and keep security intent visible at the point of implementation. Key design principles include traceable findings, conservative retrieval to avoid false positives, and continuous improvement via developer feedback. The same MCP-Dash pattern is extensible to compliance, privacy, API governance, and design reviews. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does Dropbox use MCP and Dash to bring security context into code review? Dropbox uses Dash, its internal knowledge platform, as a permission-aware retrieval layer, and Model Context Protocol as a standardized way to expose that layer to AI systems. When a pull request opens, the system retrieves relevant threat models and security requirements from Dash and surfaces them inside the code review interface, comparing design intent against the actual code change. _See how daily.dev surfaces engineering approaches like this for teams wiring AI into code review._ ### Why did Dropbox choose MCP instead of building retrieval directly into its CI or code review system? MCP let Dropbox expose Dash as a standardized context provider without a one-off integration for a single workflow, so the code review agent doesn't need to know where information lives or how it's retrieved; it just requests context while Dash handles retrieval and access control. This made the pattern reusable for privacy, compliance, API governance, and design review beyond security. _Track architectural reasoning like this on daily.dev when evaluating protocol choices for AI-assisted workflows._ ### How does Dropbox prevent its AI-assisted security code review from creating a false sense of correctness? Dropbox treats the system as evidence, not a source of truth: findings must be traceable to both the original requirement and the relevant code, the system is designed to assist rather than replace reviewer judgment, and developer feedback on accuracy and relevance continuously improves retrieval and reasoning quality, keeping false positives low. _Developers weighing AI trust tradeoffs in review tooling can follow cases like this on daily.dev._ ## Similar posts on daily.dev - [Shape Copilot code review around your team](https://daily.dev/posts/shape-copilot-code-review-around-your-team-gq7kwb9bh) · GitHub Changelog · 0 upvotes · 0 comments - [MCP leaves much to be desired when it comes to data privacy and security](https://daily.dev/posts/mcp-leaves-much-to-be-desired-when-it-comes-to-data-privacy-and-security-xbllvldf1) · SD Times · 0 upvotes · 0 comments - [Draw.io MCP for Diagram Generation: Why It’s Worth Using](https://daily.dev/posts/draw-io-mcp-for-diagram-generation-why-it-s-worth-using-zoynxq3fh) · Thomas Thornton · 257 upvotes · 6 comments - [Enhancing Trust in the MCP Ecosystem](https://daily.dev/posts/enhancing-trust-in-the-mcp-ecosystem-d7r6az0jw) · Docker · 3 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ai-coding](https://daily.dev/tags/ai-coding), [#mcp](https://daily.dev/tags/mcp), [#devsecops](https://daily.dev/tags/devsecops) [View this post on daily.dev](https://daily.dev/posts/dropbox-integrates-mcp-and-dash-to-close-the-gap-between-security-design-and-code-review-80j8hevv5) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Dropbox Integrates MCP and Dash to Close the Gap Between Security Design and Code Review","url":"https://daily.dev/posts/dropbox-integrates-mcp-and-dash-to-close-the-gap-between-security-design-and-code-review-80j8hevv5","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/dropbox-integrates-mcp-and-dash-to-close-the-gap-between-security-design-and-code-review-80j8hevv5"},"datePublished":"2026-07-31T14:41:44.006Z","dateModified":"2026-09-14T06:41:01.234Z","description":"Dropbox has built an engineering system that connects security design artifacts to code review workflows using Model Context Protocol (MCP) and its internal...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/1469a66c0b6a4e92bdda88e325c0e503?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/1469a66c0b6a4e92bdda88e325c0e503?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"InfoQ","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"InfoQ","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/afc3bced3e1e4b188dd9127017a60e0c","url":"https://daily.dev/sources/infoq"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/dropbox-integrates-mcp-and-dash-to-close-the-gap-between-security-design-and-code-review-80j8hevv5","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ai-coding,mcp,devsecops","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"InfoQ","item":"https://daily.dev/sources/infoq"},{"@type":"ListItem","position":3,"name":"Dropbox Integrates MCP and Dash to Close the Gap Between Security Design and Code Review"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/dropbox-integrates-mcp-and-dash-to-close-the-gap-between-security-design-and-code-review-80j8hevv5#faq","mainEntity":[{"@type":"Question","name":"How does Dropbox use MCP and Dash to bring security context into code review?","acceptedAnswer":{"@type":"Answer","text":"Dropbox uses Dash, its internal knowledge platform, as a permission-aware retrieval layer, and Model Context Protocol as a standardized way to expose that layer to AI systems. When a pull request opens, the system retrieves relevant threat models and security requirements from Dash and surfaces them inside the code review interface, comparing design intent against the actual code change. See how daily.dev surfaces engineering approaches like this for teams wiring AI into code review."}},{"@type":"Question","name":"Why did Dropbox choose MCP instead of building retrieval directly into its CI or code review system?","acceptedAnswer":{"@type":"Answer","text":"MCP let Dropbox expose Dash as a standardized context provider without a one-off integration for a single workflow, so the code review agent doesn't need to know where information lives or how it's retrieved; it just requests context while Dash handles retrieval and access control. This made the pattern reusable for privacy, compliance, API governance, and design review beyond security. Track architectural reasoning like this on daily.dev when evaluating protocol choices for AI-assisted workflows."}},{"@type":"Question","name":"How does Dropbox prevent its AI-assisted security code review from creating a false sense of correctness?","acceptedAnswer":{"@type":"Answer","text":"Dropbox treats the system as evidence, not a source of truth: findings must be traceable to both the original requirement and the relevant code, the system is designed to assist rather than replace reviewer judgment, and developer feedback on accuracy and relevance continuously improves retrieval and reasoning quality, keeping false positives low. Developers weighing AI trust tradeoffs in review tooling can follow cases like this on daily.dev."}}]} ```