feat(poc4): route UI through HMM MCP

poc4_active_source_20260714/HMM_BRAND_REFRESH.md

@@ -7,3 +7,8 @@
 - 기존 MCP, VPD, 데이터베이스 스키마 및 도구 계약은 변경하지 않는다.
 - 로그인 유지 기능은 서버 비밀키로 서명한 7일 만료 토큰을 사용하며, 로그아웃 시 즉시 폐기한다.
 - 화면 수정의 단일 진입점은 `src/poc4/hmm_ui.py`다. 색상·레이아웃·로그인/헤더 브랜드는 이 모듈에서만 관리한다.
+# HMM MCP runtime wiring
+
+The PoC4 MCP registry defaults to `hmm_hr_mcp` (`https://hmm-mcp.cloud-handson.com/mcp`).
+Its gateway credential is supplied only at runtime as `HMM_MCP_BEARER_TOKEN` in the
+deployed `.env`; it is intentionally not committed and is not the selected VPD user's token.

poc4_active_source_20260714/apps/poc4/mcp_discovery_ui.py

@@ -1452,6 +1452,7 @@ div[data-testid="stFormSubmitButton"] > button[data-testid="stBaseButton-primary
 class McpServer:
     server_id: str
     endpoint_url: str
+    auth_token_env: str
     default_tool: str
     tool_allowlist: tuple[str, ...]
     router_model_profile: str
@@ -3691,6 +3692,7 @@ def load_mcp_servers(path: Path = MCP_SERVERS_FILE) -> tuple[list[McpServer], in
         server = McpServer(
             server_id=server_id,
             endpoint_url=endpoint_url,
+            auth_token_env=str(item.get("auth_token_env") or "").strip(),
             default_tool=str(item.get("default_tool") or PREFERRED_TOOL).strip(),
             tool_allowlist=allowlist,
             router_model_profile=str(
@@ -6964,6 +6966,9 @@ def main() -> None:
         return
 
     default_router_model_profile = servers[default_server_index].router_model_profile
+    configured_mcp_bearer = _runtime_env_value(
+        servers[default_server_index].auth_token_env
+    )
     query_model_profile_key = "poc4_query_model_profile"
     default_query_model_profile = DEFAULT_QUERY_MODEL_PROFILE
     try:
@@ -7053,7 +7058,12 @@ def main() -> None:
             )
         else:
             selected_token_preset = None
-        if selected_token_preset is not None:
+        if configured_mcp_bearer:
+            # The HMM MCP gateway uses its own server-side credential.  VPD user
+            # tokens remain UI context only and must never be forwarded to it.
+            st.caption("MCP 인증: 서버 관리 토큰 적용")
+            manual_bearer_token = ""
+        elif selected_token_preset is not None:
             manual_bearer_token = st.text_input(
                 "Bearer token",
                 value=selected_token_preset.token,
@@ -7068,7 +7078,7 @@ def main() -> None:
                 type="default",
                 key="poc4_manual_bearer_token",
             )
-        bearer_token = (
+        bearer_token = configured_mcp_bearer or (
             selected_token_preset.token
             if selected_token_preset is not None
             else manual_bearer_token

poc4_active_source_20260714/config/mcp_servers.json

@@ -1,35 +1,22 @@
 {
-  "default_server_id": "kb_mcp",
+  "default_server_id": "hmm_hr_mcp",
   "servers": [
     {
-      "id": "kb_mcp",
+      "id": "hmm_hr_mcp",
       "enabled": true,
-      "provider": "custom_python",
+      "provider": "hmm_compat_mcp",
       "transport": "http",
-      "endpoint_url": "https://kb.cloud-handson.com/mcp",
+      "endpoint_url": "https://hmm-mcp.cloud-handson.com/mcp",
-      "base_url_env": "KB_MCP_BASE_URL",
+      "auth_token_env": "HMM_MCP_BEARER_TOKEN",
-      "auth_mode_env": "KB_MCP_AUTH_MODE",
       "timeout_seconds_env": "POC3_MCP_TIMEOUT_SECONDS",
-      "default_tool": "ords.query.kb_select_ai_vpd",
+      "default_tool": "search_hr_data",
-      "router_model_profile": "gpt55_oci",
+      "router_model_profile": "gpt54_mini_oci",
       "tool_allowlist": [
-        "ords.query.kb_select_ai_vpd"
+        "search_hr_data",
+        "resolve_hr_term",
+        "search_hr_policy"
       ],
-      "description": "KB MCP Server used by PoC_4 UI"
+      "description": "HMM HR knowledge and data MCP server"
-    },
+    }
-    {
-      "id": "kb_vector_mcp",
-      "enabled": true,
-      "provider": "custom_python",
-      "transport": "http",
-      "base_url_env": "KB_VECTOR_MCP_BASE_URL",
-      "endpoint_url": "http://127.0.0.1:9978/mcp",
-      "auth_mode_env": "KB_VECTOR_MCP_AUTH_MODE",
-      "timeout_seconds_env": "POC3_MCP_TIMEOUT_SECONDS",
-      "tool_allowlist": [
-        "hybrid_rerank_search"
-      ],
-      "description": "KB 보험 약관 검색 MCP Server used by PoC_4 UI"
-    }    
   ]
 }