v0.5.3

Added

• Added whoop-mcp-server demo-capture, a privacy-sanitized real-demo capture command for WHOOP recovery README demos and issue updates.
• The command gates on local OAuth readiness, runs the whoop_daily_summary path, writes JSON/Markdown transcripts, and fails if secrets, local token paths, raw payloads, exact recovery numbers, exact sleep details or exact strain keys appear.
• Added fixture-backed regression coverage and docs/demo/recovery-demo-redaction-contract.md so public demo captures have a reviewable privacy contract.

Verification

• npm test
• npm audit --audit-level=low
• git diff --check
• npm pack --dry-run
• GitHub CI, Pages and CodeQL passed for commit 53a46f3