I personally like https://testssl.sh/, will check a lot of things and is just one script that manages all issues. If you have a look to the documentation (https://github.com/drwetter/testssl.sh/blob/3.1dev/doc/testssl.1.md) on the section "Basic parameters" you can find a full description of how to manage the ports.
All programs can open ports. Running a firewall would prevent inbound traffic.
Running netstat -rn on Linux or OS X will show you all open ports. The ones listening on 127.0.0.1 are not open except to other local programs.