It uses the devtools protocol, see here https://chromedevtools.github.io/devtools-protocol/

Looks like it's a REST protocol.

You have to connect to a tab and then call e.g.

    Runtime.evaluate {expression: "console.log('test')"}

Also, you can apparently connect the puppeteer client to a running chrome instance [1]. That way you can use the nice and statically typed puppeteer api and you should have pretty much zero overhead.

[1] https://github.com/GoogleChrome/puppeteer/issues/238