In some circumstances it is not possible or desirable to use the default method of transporting the data from the agent through an unencrypted TCP connection on port 6556. Some of those are:

Monitoring via the internet (should be encrypted)
Monitoring hosts in a DMZ (only SSH access is possible)
Monitoring of operating systems that do not provide an easy method for binding a script to a TCP port

Check_mk allows you to specify a program to call instead of connecting port 6556. That program must output the data of the agent on stdout.