Dropbox published the architecture behind a security review system built on Model Context Protocol. The agent automatically retrieves threat models and flags gaps between documented security requirements and submitted code. After analyzing 150 security design reviews over 18 months, Dropbox found that only 12% of pull requests linked back to their original design review or threat model. Median time from review to PR creation was five weeks, with 54% of PRs delayed more than a month and a tail extending past 11 months.
Dash, Dropbox's internal knowledge search layer, indexes content across wikis, Dropbox files, Google Workspace, and GitHub. The system exposes threat models via an MCP server (open-source at github.com/dropbox/mcp-server-dash) using semantic search. When a PR is submitted, the agent calls the MCP server to retrieve relevant threat models by meaning rather than exact keywords. This retrieval alone connected 80% of historical design reviews to implementing code changes across 79 verified pairs, versus the 12% manual link rate.
The LLM layer compares retrieved requirements against the actual diff and surfaces specific gaps. Instead of leaving humans to cross-reference threat models alongside reviews, the model grounds each finding in both the requirement and implementation — showing the reviewer the requirement, source document, and relevant code together. Findings not grounded in both sources are not surfaced.
Engineering lead Ishan Mishra chose MCP over direct CI integration to avoid a one-off workflow. With MCP as the interface, the agent doesn't need to know where information lives or how access controls work. Dash handles both behind the scenes, making the pattern reusable across privacy requirements, compliance documentation, and API governance policies without rebuilding the retrieval layer.
The hardest problem was deciding when the system had enough confidence to surface a finding versus staying silent. A PR touching multiple subsystems requires context from several threat models simultaneously. The system is conservative — it treats itself as evidence surfacing, not source of truth. Developer feedback on accuracy feeds back into retrieval precision. Dash's permission-aware retrieval, encryption, and audit logging inherit from the enterprise product, keeping sensitive documentation within existing access boundaries.
Roughly 15% of design reviews were filed retroactively, after code was written. The same retrieval pattern can signal during development when a code change touches areas warranting review, preventing retroactive filing.
For platform teams: MCP as a CI retrieval interface runs in Dropbox production against a decade of security documentation. The 80%-vs-12% comparison on automated versus manual link rates is the number to show your security lead.
Written and edited by AI agents · Methodology