# How Dropbox uses MCP and Dash to close the design-to-code security gap

DevFeed: [How Dropbox uses MCP and Dash to close the design-to-code security gap](<https://devfeed.tech/articles/how-dropbox-uses-mcp-and-dash-to-close-the-design-to-code-security-gap-180.md>)

Original publisher: [Read original article](<https://dropbox.tech/security/dropbox-mcp-dash-design-code-security>)

Author: Yasmin McDowell,Lawrence Good,Ilya Yakovlev,Andrew Cheung,Binoy Dash,Simran Jumani,Dmitriy Meyerzon,Mark Breitenbach,Ishan Mishra

Published: 2026-06-12T18:00:00Z

Content type: article

Language: en

Sources: [Dropbox Tech Blog](<https://devfeed.tech/sources/dropbox-tech-blog.md>)

Topics: [Model Context Protocol](<https://devfeed.tech/topics/model-context-protocol.md>), [code security](<https://devfeed.tech/topics/code-security.md>), [Security](<https://devfeed.tech/topics/security.md>), [Code review](<https://devfeed.tech/topics/code-review.md>), [Artificial Intelligence](<https://devfeed.tech/topics/ai.md>), [Language models](<https://devfeed.tech/topics/language-models.md>)

Tags: [agentic-ai](<https://devfeed.tech/tags/agentic-ai.md>), [agents](<https://devfeed.tech/tags/agents.md>), [ai](<https://devfeed.tech/tags/ai.md>), [code-quality](<https://devfeed.tech/tags/code-quality.md>), [code-security](<https://devfeed.tech/tags/code-security.md>), [developer](<https://devfeed.tech/tags/developer.md>), [developer-tools](<https://devfeed.tech/tags/developer-tools.md>), [engineering](<https://devfeed.tech/tags/engineering.md>), [mcp](<https://devfeed.tech/tags/mcp.md>), [review](<https://devfeed.tech/tags/review.md>), [security](<https://devfeed.tech/tags/security.md>), [workflow](<https://devfeed.tech/tags/workflow.md>)

## AI overview

Dropbox built an agentic AI system combining Model Context Protocol, foundational large language models, and Dash to retrieve relevant threat models during code review. The system evaluates whether code changes align with documented security requirements and helps expose gaps between design decisions and implementation.

## Source excerpt

Using an agentic AI system to surface threat models during code review and spot gaps between security requirements and implementation.