I managed to finish the addons manager. Addons are in zip files on the server. When they get downloaded, some payload will be attached on the fly to the exe. This payload contains information about the addon:

ID: A unique ID identifying the addon, which is also the value stored in the mysql database
NAME: The name of the addon, will be used for the menu entry
ADDONFILENAME: The exe name of the addon
VERSION: The version of the addon (like 1.0.0.0)
AMOUNT: The price of the addon (if not free)
PURCHASED: If the addon was purchased
SCRAPELINKER_VERSION: The minimum version of ScrapeLinker required to run the addon
HASH: A MD5 hash of the exe itself, without the payload

This info is encrypted, using the local crypto api to prevent that they can send the addon to other users.
When SL scan the local addons to build the addons menu, it will require this info. When the addon runs (be it from SL or manually), it will check its own payload and also the stored hash to ensure its allowed to run (and was not modified).
If no payload exist, or the payload cannot be decrypted, or the hash does not match, the addon wont run.

To generate the addons.json file on the server (similar the addons.txt of SB, where all the addons are listed), I created an editor for it, where you can load that file from the server (or local), add/edit/delete addon details and upload it to the server (or save it locally).