I'm not sure if Thunderbird stores the local copies as SQLite databases or the weirdo Mozilla internal format (Mork, more comments by jwz). According to some random comments on the internet, global-messages-db.sqlite in your profile directory is the index into all the (local) messages, so you might get by with running the SQL against that file (DBD::SQLite and/or my DBIx::RunSQL).

If you are lucky, getting the results is merely running the SQL query against the SQLite database in the INBOX file (which might be an SQLite database).

If you are unlucky, you need to read/import the Mork format into SQLite to then run the SQL query against that.

If you are adventurous, you can try to create a converter from SQL to IMAP queries to run the search query directly on the remote IMAP server, but I think that's the approach least likely to be successful.

Update:

Having looked at the .msf files, they seem to contain maybe IMAP queries, but certainly not SQL.

On the other hand, the global-messages-db.sqlite file in your profile contains basically a copy of all mails as a cache for Thunderbird.

I would look at querying that SQLite file. You might want to maybe find out how to make SQLite ignore locks on the sqlite database so that you can read it while Thunderbird is still running.