Looking at GhostText and its editor integration scripts, those basically work by running a websocket server on localhost. Implementing access controls seems to be left as an exercise for the reader.

If I understand the native messaging API correctly, nothing in there requires the presence of any networking daemon. The browser just execs a program you can communicate with using JSON messages on stdin/stdout. That is already a lot better than I thought.