I think that at the beginning, this can be something really simple, providing an endpoint to invoke the current plugin API (that I cannot find), and serializes the results in JSON.
For example ‘search for notes’. The results could come in a JSON, providing URLs to the hits.
obsidian://open?path=the_note.md
This could be delivered as a Plugin, that exposes the API that needs a security token (defined in the plugin config)