I have a node proof of concept that pipes data to a running

osqueryi

process and return results–presumably that’s the piece that would be replaced by thrift.