Dropbox integrates MCP and Dash for secure code reviews

Dropbox has launched a new engineering workflow that integrates the Model Context Protocol (MCP) with its internal knowledge search engine, Dash, to link security design documents directly to code reviews. Developed under the leadership of engineering lead Ishan Misha, this system addresses the common industry challenge where security requirements established during early design phases are lost or ignored by the time developers submit pull requests. By connecting these two phases, Dropbox aims to make security documentation an active part of the development lifecycle.

The architecture relies on Dash to serve as a centralized, permission-aware indexing and retrieval layer across internal documentation. When a developer opens a pull request, the system identifies the code changes and uses MCP as a standardized orchestration layer to query Dash. It then retrieves relevant threat models and security requirements, presenting this context directly within the code review interface. This setup prevents the need for custom, one-off integrations for every workflow and ensures that sensitive data access controls are strictly maintained.

For software practitioners, this integration significantly reduces context switching and cognitive load during code reviews. Instead of manually searching through disconnected repositories or stale wikis to verify compliance, reviewers receive targeted, traceable evidence directly alongside the code. Misha emphasizes that the system is designed to assist human reviewers rather than automate security decisions, meaning it flags potential gaps between design intent and implementation without replacing human judgment. This helps engineering teams maintain high security standards and avoid alert fatigue by keeping findings highly relevant and grounded in the actual codebase.