diff --git a/tests/scripts/quiet/quiet b/tests/scripts/quiet/quiet
new file mode 100755
index 0000000..2279e6a
--- /dev/null
+++ b/tests/scripts/quiet/quiet
@@ -0,0 +1,65 @@
+#! /usr/bin/env bash
+#
+# Copyright The Mbed TLS Contributors
+# SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
+#
+# This swallows the output of the wrapped tool, unless there is an error.
+# This helps reduce excess logging in the CI.
+
+# If you are debugging a build / CI issue, you can get complete unsilenced logs
+# by un-commenting the following line (or setting VERBOSE_LOGS in your environment):
+# VERBOSE_LOGS=1
+
+# Locate original tool
+ORIGINAL_TOOL=$(type -ap "${TOOL}" | grep -v -Fx "$0" | head -n1)
+
+print_quoted_args() {
+    # similar to printf '%q' "$@"
+    # but produce more human-readable results for common/simple cases like "a b"
+    for a in "$@"; do
+        simple_pattern='^([[:alnum:]_+-]+=)?([[:alnum:] _=+-./:@]*)$'
+        if [[ $a =~ ' ' && $a =~ $simple_pattern ]]; then
+            # a has spaces, but no other special characters that need escaping
+            # (quoting after removing spaces yields no backslashes)
+            # simplify quoted form - e.g.:
+            #   a b        -> "a b"
+            #   CFLAGS=a b -> CFLAGS="a b"
+            q="${BASH_REMATCH[1]}\"${BASH_REMATCH[2]}\""
+        else
+            # get bash to do the quoting (which may result in no quotes or escaping,
+            # if none is needed).
+            q=$(printf '%q' "$a")
+        fi
+        printf "%s " "$q"
+    done
+}
+
+if [[ ! " $* " =~ " --version " ]]; then
+    # Display the command being invoked - if it succeeds, this is all that will
+    # be displayed. Don't do this for invocations with --version, because
+    # this output is often parsed by scripts, so we don't want to modify it.
+    printf %s "${TOOL} "
+    print_quoted_args "$@"
+    echo
+fi
+
+if [[ " $@ " =~ $NO_SILENCE || -n "${VERBOSE_LOGS}" ]]; then
+    # Run original command with no output supression
+    exec "${ORIGINAL_TOOL}" "$@"
+else
+    # Run original command and capture output & exit status
+    TMPFILE=$(mktemp "quiet-${TOOL}.XXXXXX")
+    "${ORIGINAL_TOOL}" "$@" > "${TMPFILE}" 2>&1
+    EXIT_STATUS=$?
+
+    if [[ $EXIT_STATUS -ne 0 ]]; then
+        # On error, display the full output
+        cat "${TMPFILE}"
+    fi
+
+    # Remove tmpfile
+    rm "${TMPFILE}"
+
+    # Propagate the exit status
+    exit $EXIT_STATUS
+fi