macOS Local Network Privacy: why your CLI gets EHOSTUNREACH and how to fix it

If you run a local model server, an MCP server, or anything else on your LAN, you have probably hit this: curl http://192.168.1.50:11434/v1/models returns a model list, nc -vz 192.168.1.50 11434 succeeds, and your tool still fails with:

AI_APICallError: Cannot connect to API: Was there a typo in the url or port?
  cause: Error: Was there a typo in the url or port?
   code: "FailedToOpenSocket"

or, from Node:

connect EHOSTUNREACH 192.168.1.50:11434

The URL is right, the port is open, and the server is up. The error is misleading, because the connection never leaves your machine.