I used the helper file to read the DOM. I guess it could do AJAX as well, but if a site required being logged in you would need to pass that along somehow.
Offhand I know of three plugins that work with he database. Each has SQL stuff in its the top level plugin.rb file in heredoc syntax.
https://github.com/discourse/discourse-data-explorer
https://github.com/discourse/discourse-tagging
(Tagging has since been moved into the Core)