Whoever hosts the Web Inspector frontend page has the real connection to the backend. The host provides an InspectorFrontendHost global object to the frontend page that can be used to send messages through that already established connection. Likewise when the host wants to trigger operations in the frontend page it calls methods on InspectorFrontendAPI.
• The frontend page uses InspectorFrontendHost.sendMessageToBackend to send JSON Inspector Protocol messages to the backend. This is never used directly, we generate APIs that construct the JSON messages that get sent through this.
• The frontend page receives messages from the backend through InspectorFrontendAPI.prototype.dispatchMessageAsync. Again generated APIs route these incoming messages to more convenient places such as domain observers or callbacks for earlier commands.
On the native side you can look at WebInspectorProxy::sendMessageToBackend to see how the frontend host's native connection to the backend is used and related code to see how it was established. Ultimately only a Inspector::FrontendChannel needs to be provided to WebCore's InspectorController to establish a backend <-> frontend connection. So you can set a breakpoint on WebCore::InspectorController::connectFrontend and see how / where it gets triggered. The common case in WebKit2 happens under WebKit::WebInspector::show.